Re: eSafe: Could this be exploited?

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear Hugo van der Kooij,

--Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq () securityfocus com:

HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the
HvdK> end-user before they stop a virus. Then they rely on the adding of the
HvdK> exact URL so that URL can be blocked in all next requests.

It depends on how antiviral check is actually implemented. If connection
is  broken  immediately after signature is detected - there is no way to
download  infected  file,  because signature will not pass to client and
client  will  not  be  able  to  use "Range:" header to resume partially
downloaded  file.

If  antiviral  filter  checks data _after_ all data received from client
with  20%  buffering  yes,  it's possible to bypass this check for HTTP,
because  there  is  no  way  (at least for HTTP/1.0 and FTP) to indicate
error to client and make him to delete partially downloaded data.

You can check it, by sending EICAR with some additional data: if you can
find  EICAR  signature  on  the  client  after  connection  is broken by
antiviral filter you can bypass it's protection.


-- 
~/ZARAZA
Машина оказалась способной к единственному действию,
а именно умножению 2x2, да и то при этом ошибаясь. (Лем)