RE: Av issuesMar 14 2005 07:11PM David Webster (dwebster wittig com) (1 replies)
Symantec Corporate AV client v 9.0.3.1000 with virus defs 3/9/2005 rev.
32 detected ICAR test string in the zip file listed in the poc url.
-----Original Message-----
From: Bipin Gautam [mailto:visitbipin (at) hotmail (dot) com [email concealed]]
Sent: Saturday, March 12, 2005 4:40 AM
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Av issues
In-Reply-To: <20050311203150.17236.qmail (at) www.securityfocus (dot) com [email concealed]>
In Local file header if you modify "general purpose bit flag" 7th & 8'th
byte of a zip archive with \x2f ie: "\" F-port, Kaspersky, Mcafee,
Norman, Sybari, Symantec seem to skip the file marking it as clean!!!
This was discovered during the analysis of "Multiple AV Vendor Incorrect
CRC32 Bypass Vulnerability."
Quick/rough conclusion were drawn using www.virustotal.com
poc: http://www.geocities.com/visitbipin/gpbf.zip
Well, tested with F-prot, DrWeb, *Symantec 8.0 long ago... lately
verified it using virustotal.com If you have a long archive coment... in
a zip archive these AV can't detect virus embedded in it. I came to know
Symantec 8.1 is immune to the bug?
32 detected ICAR test string in the zip file listed in the poc url.
-----Original Message-----
From: Bipin Gautam [mailto:visitbipin (at) hotmail (dot) com [email concealed]]
Sent: Saturday, March 12, 2005 4:40 AM
To: bugtraq (at) securityfocus (dot) com [email concealed]
Subject: Av issues
In-Reply-To: <20050311203150.17236.qmail (at) www.securityfocus (dot) com [email concealed]>
In Local file header if you modify "general purpose bit flag" 7th & 8'th
byte of a zip archive with \x2f ie: "\" F-port, Kaspersky, Mcafee,
Norman, Sybari, Symantec seem to skip the file marking it as clean!!!
This was discovered during the analysis of "Multiple AV Vendor Incorrect
CRC32 Bypass Vulnerability."
Quick/rough conclusion were drawn using www.virustotal.com
poc: http://www.geocities.com/visitbipin/gpbf.zip
Well, tested with F-prot, DrWeb, *Symantec 8.0 long ago... lately
verified it using virustotal.com If you have a long archive coment... in
a zip archive these AV can't detect virus embedded in it. I came to know
Symantec 8.1 is immune to the bug?
POC: http://www.geocities.com/visitbipin/long_coment.zip
regards,
bipin gautam
[ reply ]