BugTraq
Anti-Virus Malformed ZIP Archives flaws [UPDATE] Jun 14 2005 07:08PM
Thierry Zoller (Thierry sniff-em com) (1 replies)
Re: Anti-Virus Malformed ZIP Archives flaws [UPDATE] Jun 20 2005 06:37PM
Nicholas Knight (nknight runawaynet com)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thierry Zoller wrote:
> Antigen.zip (fake compressed size and uncompressed size values)
> ---------------------------------------------------
> Failed:

<snip>

> McAfee 4513

<snip>

The Antigen.zip test is flawed. The EICAR test file, by definition, is a
maximum of 128 bytes [1]. Technically, it shouldn't even have anything
other than the test string and whitespace in it. McAfee picks it up even
with garbage rather than whitespace after it, but only if it's small
enough (I tested it with the header sizes forged to 127 bytes instead of
255 [2] and McAfee picked it up just fine). Presumably, mindful of the
defined limitations of the EICAR test file, McAfee won't pick up EICAR
in files >128 bytes in order to avoid complications from EICAR appearing
in documents not intended for scanner testing (like [1]).

If you really want to find out if scanners are vulnerable to this,
you'll probably need to use a real virus in the zip.

[1] http://www.eicar.org/anti_virus_test_file.htm

[2] You can find the file I used here:
http://runawaynet.com/~nknight/avt/Antigen-forgedcrc-fixedsize.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org

iD8DBQFCtwzzUsZlh+GmLlQRAgADAKDFBu6gC+LEXVaholDSPqBZ1Vvq8QCdG97m
S+fxK1JfFLRDNa/vQsctTlg=
=Jr2u
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus