SecurityFocus

Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 06 2006 02:24PM
Hendrik Weimer (hendrik enyo de) (2 replies)

Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 07 2006 02:15PM
Tomasz Kojm (tkojm clamav net) (3 replies)

On Wed, 06 Dec 2006 15:24:25 +0100
Hendrik Weimer <hendrik (at) enyo (dot) de [email concealed]> wrote:

> Several e-mail virus scanners can be tricked into passing an EICAR
> test file if the following conditions are met:
>
> 1. the EICAR file is encoded in Base64 including characters not in the
> standard alphabet (e.g. whitespaces) and
> 2. the part containing the EICAR file is nested within one or several
> levels of multipart/mixed content.
>
> Details and PoC can be found at:
> http://www.quantenblog.net/security/virus-scanner-bypass

That's _extremely_ irresponsible to disclose bugs without giving the vendors
any chance to fix them and prepare new software releases.

--
oo ..... Tomasz Kojm <tkojm (at) clamav (dot) net [email concealed]>
(\/)\......... http://www.ClamAV.net/gpg/tkojm.gpg
\..........._ 0DCA5A08407D5288279DB43454822DC8985A444B
//\ /\ Thu Dec 7 15:13:35 CET 2006

[ reply ]

Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 07 2006 07:33PM
michele.sandrelli (at) katamail (dot) com [email concealed] (michele sandrelli katamail com)

Re[2]: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 07 2006 07:00PM
3APA3A (3APA3A SECURITY NNOV RU) (1 replies)

Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 07 2006 07:31PM
Tomasz Kojm (tkojm clamav net)

Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 07 2006 05:57PM
Luke Borg (lborg hcssystems com)

Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass Dec 07 2006 12:30PM
Gadi Evron (ge linuxbox org)