Symantec Scan Engine 5.1.2 RAR File Denial of Service Vulnerability（Public Advisory: 02.26.08 // iDefense Labs）

ICAPを使って1334/TCPの通信が存在するがそこでDoSを受けるような、スタックベースバッファオーバーフローが発生するそうです。

Remote exploitation of a Denial of Service vulnerability in Symantec Scan Engine version 5.1.2 could allow an unauthenticated attacker to create a denial of service (DoS) condition.
Symantec Scan Engine listens on TCP port 1344 to accept files for scanning using the Internet Content Adaptation Protocol (ICAP). If the service is sent a malformed RAR file, the service will consume massive amounts of memory. This can result in a denial of service condition for the application and operating system.

---