oss-sec mailing list archives
Re: ClamAV small issues
From: Ludwig Nussel <ludwig.nussel () suse de>
Date: Fri, 9 Apr 2010 10:30:19 +0200
Kurt Seifried wrote:
On Wed, Apr 7, 2010 at 6:02 PM, Josh Bressers <bressers () redhat com> wrote:These are certainly worth of CVE ids, but it's going to be tricky, as the first issue is a couple of things as seen in the bug: https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1826 I'm going to defer this assignment to MITRE (added Steve Christey to the CC). Thanks.This already appears to have a CVE, fromt he bug report: ReversingLabs Corp approached CERT-FI about detection evasion attacks found in many Antivirus software and other signature-based protection software. In short, the case is related to falures when parsing archive formats. ?ReversingLabs Corp has crafted 15 ZIP, CAB, 7Z and RAR archive files that are considered valid by the relevant decompressors, but signature based detection systems cannot detect malicious content contained within them.
Do such issues really need to be flagged as vulnerabilities? A virus scanner cannot detect all possible malware in any possible container anyways. So it's kind of natural that new releases enhance the methods to find even more hiding places. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Current thread:
- ClamAV small issues Jamie Strandboge (Apr 06)
- Re: ClamAV small issues Josh Bressers (Apr 07)
- Re: ClamAV small issues Kurt Seifried (Apr 07)
- Re: ClamAV small issues Ludwig Nussel (Apr 09)
- Re: ClamAV small issues Eren Türkay (Apr 09)
- Re: ClamAV small issues Eren Türkay (Apr 09)
- Re: ClamAV small issues Ludwig Nussel (Apr 09)
- Re: ClamAV small issues Kurt Seifried (Apr 07)
- Re: ClamAV small issues Josh Bressers (Apr 07)