Bugtraq mailing list archives
Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through
From: "Andrey Bayora" <andrey () securityelf org>
Date: Fri, 28 Oct 2005 19:41:14 +0200
Hello Mark,
vulnerability is limited in our products to one specific type of potential virus file
It is .bat files (if I remember).
which is not commonly allowed in most IT systems
Yes, I think organizations must implement good e-mail policy that blocks all executable file types (or allow some file types that needed for business and block the rest).
and needs to be executed manually
Maybe it is not always true if some virus drops locally .bat file and then executes it. I did not check this issue with the current definitions and updates, but important point is that I used .bat, .html and .eml file types with the magic byte of .exe file - I believe that such vulnerability can be implemented with other file types and possibly with other magic byte. The vendors must patch the LOGIC (algorithm) of the scanning to address this issue. Best regards, Andrey Bayora. ----- Original Message ----- From: <mgotts () 2roads com> To: "Andrey Bayora" <andrey () securityelf org> Cc: <bugtraq () securityfocus com> Sent: Friday, October 28, 2005 6:52 PM Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through
Multiple Vendor Anti-Virus Software Detection Evasion Vulnerabilitythroughforged magic byte.AUTHOR: Andrey Bayora (www.securityelf.org)For more details, screenshots and examples please read my article "TheMagicof magic byte" at www.securityelf.org . In addition, you will find asample"triple headed" program which has 3 different 'execution entrypoints',depending on the extension of the file (exe, html or eml) - justchange theextension and the SAME file will be executed by (at least) THREEDIFFERENTprograms! (thanks to contributing author Wayne Langlois from www.diamondcs.com.au).Below I copied Trend Micro's response to the "magic byte" vulnerability in their products: ======================================== Dear Valued Client, Greetings! My name is <removed>. I will be the one handling your case. Please correct me if I left some issues or if I misunderstood your concern. Trend Micro is aware of a potential vulnerability related to the "forged magic byte" in certain file types. Based on our analysis, this vulnerability is limited in our products to one specific type of potential virus file which is not commonly allowed in most IT systems and needs to be executed manually. Trend Micro customers are currently able to detect such files -- should they be created -- through our virus pattern file, 2.915.00. Please make sure that you regularly update your virus definitions. Hope this information helps. ======================================== Any comments on their response? -- Mark
Current thread:
- Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through Andrey Bayora (Oct 25)
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through Dave English (Oct 29)
- <Possible follow-ups>
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through Andreas Marx (Oct 26)
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through Andrey Bayora (Oct 26)
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through mgotts (Oct 29)
- Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through Andrey Bayora (Oct 29)