Re: Anti-Virus Malformed ZIP Archives flaws [UPDATE]

[Nicholas Knight <nknight () runawaynet com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thierry Zoller wrote:
> Antigen.zip (fake compressed size and uncompressed size values)
> ---------------------------------------------------
> Failed:

<snip>

> McAfee             4513

<snip>

The Antigen.zip test is flawed. The EICAR test file, by definition, is a
maximum of 128 bytes [1]. Technically, it shouldn't even have anything
other than the test string and whitespace in it. McAfee picks it up even
with garbage rather than whitespace after it, but only if it's small
enough (I tested it with the header sizes forged to 127 bytes instead of
255 [2] and McAfee picked it up just fine). Presumably, mindful of the
defined limitations of the EICAR test file, McAfee won't pick up EICAR
in files >128 bytes in order to avoid complications from EICAR appearing
in documents not intended for scanner testing (like [1]).

If you really want to find out if scanners are vulnerable to this,
you'll probably need to use a real virus in the zip.


[1] http://www.eicar.org/anti_virus_test_file.htm

[2] You can find the file I used here:
http://runawaynet.com/~nknight/avt/Antigen-forgedcrc-fixedsize.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org

iD8DBQFCtwzzUsZlh+GmLlQRAgADAKDFBu6gC+LEXVaholDSPqBZ1Vvq8QCdG97m
S+fxK1JfFLRDNa/vQsctTlg=
=Jr2u
-----END PGP SIGNATURE-----