Multiple AV Vendor Incorrect CRC32 BypassVulnerability.

["Steve Scholz" <steve_scholz () sybari com>]

Actually by removing the file name size you made the Eicar.com invalid.
Antigen does scan this file and when it extracts the eicar.com.txt we
get a 
eicar.com.txtX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TE
<mailto:eicar.com.txtX5O!P%25@AP%5b4\PZX54(P%5e)7CC)7%7d$EICAR-STANDARD-
ANTIVIRUS-TE>  in the text file rather then a valid eicar. Since you
made the name length a zero when pasred the name of the zipped file
becomes part of the file and the info at the end is truncated making the
file if it was viral, non-viral or if it were able to be executed after
this process is done it would be an invalid application and it would not
be executed. I used ziprepairpro and came up with the same results.

 

If a file filter is set up for exe, pif ,scr ect we will remove the file
from the zip and rewrite it with a txt file that can be extracted and
read. If a doc file is put into a zip of this nature with an embedded
eicar in it we do detect the ecar as long as there is info after the
embedded file to be truncated.

 

 

 

Steve Scholz
Corporate Sales Engineer-North America
Sybari Software, Inc.
631-630-8556 Direct
516-903-2464 Mobile

Email:  Steve_scholz () sybari com <mailto:Steve_scholz () sybari com> 

MSN IM:Steve_Scholz () Msn com <mailto:Steve_Scholz () Msn com>  (email never
checked) 

<http://www.sybari.com/>   <http://www.sybari.com/> 

 

-----Original Message-----

From: full-disclosure-bounces () lists grok org uk

[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of bipin
gautam

Sent: Wednesday, March 09, 2005 9:37 PM

To: full-disclosure () lists grok org uk

Cc: vuln () secunia com

Subject: [Full-disclosure] Multiple AV Vendor Incorrect CRC32
BypassVulnerability.

 

 

Multiple AV Vendor Incorrect CRC32 Bypass Vulnerability.

 

Affected Product:

AVG 718

Sybari (Antigen for M$ exchange) 7.5.1314 Symantec 8.0 McAfee 4442
BitDefender 7.0

 

 

Description:

if you create a zip archive with invalid CRC checksum...... some AV skip
scanning the archive marking it as clean........ by this way, you can
bypass antivirus gateways and slip in any attachment without scanning
the archive. Moreover, these days....

software tools automatically repair a *broken* archive.

 

Vendor notification: I've lost faith in responsible disclosure... long
ago! Moreover, vendors don't respond in timely manner.

 

regards,

Bipin Gautam

http://www.geocities.com/visitbipin/

 

 

Disclaimer: The information in the advisory is believed to be accurate
at the time of printing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.

There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect
or consequential loss or damage arising from use of, or reliance on this
information.

 

 

__________________________________________________

Do You Yahoo!?

Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com <http://mail.yahoo.com/>
_______________________________________________

Full-Disclosure - We believe in it.

Charter: http://lists.grok.org.uk/full-disclosure-charter.html

Hosted and sponsored by Secunia - http://www.secunia.com/

 

<http://www.sybari.com/>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://www.secunia.com/