Re: Multi-vendor AV gateway image inspection bypass vulnerability

[Trog <trog () uncon org>]

Quoting Darren Bounds <dbounds () intrusense com>:

> Multi-vendor AV gateway image inspection bypass vulnerability
> January 10, 2005
>
> A vulnerability has been discovered which allows a remote attacker
> to bypass anti-virus
> (as well other security technologies such as IDS and IPS) inspection
> of HTTP image content.
>
> By leveraging techniques described in RFC 2397 for base64 encoding  
> image content within
> the URL scheme. A remote attack may encode a malicious image within
> thebody of an HTML
> formatted document to circumvent content inspection.

Support for extracting RFC2397 encoded data within HTML documents has
been added to the CVS version of Clam AntiVirus, the open source virus
scanner.

The next stable release containing this feature, version 0.81 is
scheduled to become a Release Candidate on 19th Jan.

Until that time, access to the current development code is available via
CVS and nightly tarballs. See www.clamav.net for download details.

Thanks,
-trog


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html