Bugtraq mailing list archives
Re[2]: Multiple Vendor Unusual MIME Encoding Content Filter Bypass
From: 3APA3A <3APA3A () SECURITY NNOV RU>
Date: Thu, 7 Dec 2006 22:00:31 +0300
Dear Tomasz Kojm, TK> That's _extremely_ irresponsible to disclose bugs without giving the vendors TK> any chance to fix them and prepare new software releases. This is a rare case I can not agree with such statement. Ability to bypass content filter is not a bug before this issues is used in-the-wild, like ability to write undetectable virus is not a bug in antivirus. It may be simply impossible to find all vendors and wait for all fixes. Ability to bypass content filter is a common case, especially for "passive" filters not changing message content. It arises from the fact different client applications and different content filters use different algorithms. It's possible to create message with "fork": if you make one assumption you miss attachment for Microsoft, if another - you miss attachment for Mozilla. It's simply impossible to find malware for all possible clients without normalization of the message. Message normalization may, in it's turn, break digital signatures. This problems and known methods of bypassing are discussed here: http://www.security.nnov.ru/advisories/content.asp I regularly update this whitepaper with newly discovered methods. Please report if you know any content filtering bypassing method I missed. --Thursday, December 7, 2006, 5:15:50 PM, you wrote to hendrik () enyo de:
Several e-mail virus scanners can be tricked into passing an EICAR test file if the following conditions are met: 1. the EICAR file is encoded in Base64 including characters not in the standard alphabet (e.g. whitespaces) and 2. the part containing the EICAR file is nested within one or several levels of multipart/mixed content. Details and PoC can be found at: http://www.quantenblog.net/security/virus-scanner-bypass
TK> That's _extremely_ irresponsible to disclose bugs without giving the vendors TK> any chance to fix them and prepare new software releases. -- ~/ZARAZA Патриотизм - это та же религия. (Твен)
Current thread:
- Multiple Vendor Unusual MIME Encoding Content Filter Bypass Hendrik Weimer (Dec 06)
- Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Tomasz Kojm (Dec 07)
- Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Luke Borg (Dec 07)
- Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass michele.sandrelli () katamail com (Dec 07)
- Re[2]: Multiple Vendor Unusual MIME Encoding Content Filter Bypass 3APA3A (Dec 07)
- Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Tomasz Kojm (Dec 07)
- Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Gadi Evron (Dec 07)
- Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Tomasz Kojm (Dec 07)