bugtraq - Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 28 Oct 2005 09:52:38 -0700
From: mgotts@...ads.com
To: Andrey Bayora <andrey@...urityelf.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability
 through

> > Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability 
through
> > forged magic byte.
> 
> > AUTHOR: Andrey Bayora (www.securityelf.org)
> 
> > For more details, screenshots and examples please read my article "The 
Magic
> > of magic byte" at www.securityelf.org . In addition, you will find a 
sample
> > "triple headed" program which has 3 different 'execution entry 
points',
> > depending on the extension of the file (exe, html or eml) - just 
change the
> > extension and the SAME file will be executed by (at least) THREE 
DIFFERENT
> > programs! (thanks to contributing author Wayne Langlois from
> > www.diamondcs.com.au).
> 

Below I copied Trend Micro's response to the "magic byte" vulnerability in 
their products:

========================================
Dear Valued Client,

Greetings!

My name is <removed>. I will be the one handling your case.

Please correct me if I left some issues or if I misunderstood your 
concern.

Trend Micro is aware of a potential vulnerability related to the "forged 
magic byte" in certain file types. Based on our analysis, this 
vulnerability is limited in our products to one specific type of potential 
virus file which is not commonly allowed in most IT systems and needs to 
be executed manually. Trend Micro customers are currently able to detect 
such files -- should they be created -- through our virus pattern file, 
2.915.00.

Please make sure that you regularly update your virus definitions. Hope 
this information helps.

========================================

Any comments on their response?

-- Mark