BugTraq
Back to list
|
Post reply
Re: [Full-disclosure] Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning
Mar 15 2005 04:45PM
Dr. Peter Bieringer (pbieringer aerasec de)
(1 replies)
--On Dienstag, 15. März 2005 08:34 -0800 bipin gautam
<visitbipin (at) yahoo (dot) com [email concealed]> wrote:
> I STIL FIND IT happy to
> see there are lot of AV out there that cant scan such
> file properly to detect virus.
The problem must be located in the unzip engine:
We've created a mixed ZIP now:
# unzip -l mixed-eicar.zip
Archive: mixed-eicar.zip
Length Date Time Name
-------- ---- ---- ----
308 03-10-05 12:00 Test^G^[[2J^[[2;5m^[[1;31mHACKER
ATTACK^[[2;25m^[[22;30m^[[3q.txt
308 03-10-05 12:00 eicarcom2.zip
-------- -------
616 2 files
BTW: note here that "unzip" displays the escape sequences very proper!
Available here:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/mixed-e
icar.zip>
Some AV software detect the virus only in second part of the ZIP file, so
it looks like the first one is really skipped and not analysed.
Peter
--
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Strasse 1 Mobile: +49-174-9015046
D-85662 Hohenbrunn E-Mail: pbieringer (at) aerasec (dot) de [email concealed]
Germany Internet: http://www.aerasec.de
[ reply ]
Re: [Full-disclosure] Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning
Mar 15 2005 05:29PM
Rodrigo Barbosa (rodrigob suespammers org)
Privacy Statement
Copyright 2010, SecurityFocus
--On Dienstag, 15. März 2005 08:34 -0800 bipin gautam
<visitbipin (at) yahoo (dot) com [email concealed]> wrote:
> I STIL FIND IT happy to
> see there are lot of AV out there that cant scan such
> file properly to detect virus.
The problem must be located in the unzip engine:
We've created a mixed ZIP now:
# unzip -l mixed-eicar.zip
Archive: mixed-eicar.zip
Length Date Time Name
-------- ---- ---- ----
308 03-10-05 12:00 Test^G^[[2J^[[2;5m^[[1;31mHACKER
ATTACK^[[2;25m^[[22;30m^[[3q.txt
308 03-10-05 12:00 eicarcom2.zip
-------- -------
616 2 files
BTW: note here that "unzip" displays the escape sequences very proper!
Available here:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/mixed-e
icar.zip>
Some AV software detect the virus only in second part of the ZIP file, so
it looks like the first one is really skipped and not analysed.
Peter
--
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Strasse 1 Mobile: +49-174-9015046
D-85662 Hohenbrunn E-Mail: pbieringer (at) aerasec (dot) de [email concealed]
Germany Internet: http://www.aerasec.de
[ reply ]