|
|
BugTraq
eSafe: Could this be exploited? Jul 23 2004 06:21PM Hugo van der Kooij (hvdkooij vanderkooij org) (3 replies) Re: eSafe: Could this be exploited? Jul 24 2004 11:27AM 3APA3A (3APA3A SECURITY NNOV RU) (2 replies) Re: eSafe: Could this be exploited? Jul 26 2004 05:26AM MegaHz (megahz gmail com) (1 replies) Re: eSafe: Could this be exploited? Jul 26 2004 08:26PM Hugo van der Kooij (hvdkooij vanderkooij org) (1 replies) Re: eSafe: Could this be exploited? Jul 23 2004 07:49PM Oliver (at) greyhat (dot) de [email concealed] (Oliver greyhat de) |
|
Privacy Statement |
On Sat, 2004-07-24 at 14:27, 3APA3A wrote:
> Dear Hugo van der Kooij,
>
> --Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq (at) securityfocus (dot) com [email concealed]:
>
> HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the
> HvdK> end-user before they stop a virus. Then they rely on the adding of the
> HvdK> exact URL so that URL can be blocked in all next requests.
>
> It depends on how antiviral check is actually implemented. If connection
> is broken immediately after signature is detected - there is no way to
> download infected file, because signature will not pass to client and
> client will not be able to use "Range:" header to resume partially
> downloaded file.
>
> If antiviral filter checks data _after_ all data received from client
> with 20% buffering yes, it's possible to bypass this check for HTTP,
> because there is no way (at least for HTTP/1.0 and FTP) to indicate
> error to client and make him to delete partially downloaded data.
>
> You can check it, by sending EICAR with some additional data: if you can
> find EICAR signature on the client after connection is broken by
> antiviral filter you can bypass it's protection.
>
[ reply ]