Date: Thu, 13 Feb 2020 13:46:28 +0100
From: Thierry Zoller <thierry@...ler.lu>
To: fulldisclosure@...lists.org, submissions@...ketstormsecurity.com,
  bugtraq@...urityfocus.com
Cc: "soc@...cert.gov" <soc@...cert.gov>, info@...cl.lu, ju@...sec.de
Subject: [TZO-13-2020] - AVIRA Generic AV Bypass (ZIP GPFLAG)

________________________________________________________________________

                 From the low-hanging-fruit-department
	AVIRA Generic Malformed Container bypass (ZIP GPFLAG)
________________________________________________________________________

Release mode    : No Patch - Coordinated otherwise
Ref             : [TZO-13-2020] - AVIRA Generic AV Bypass (ZIP GPFLAG)
Vendor          : AVIRA
Status          : Not Patched
CVE             : none provided,
Blog            : 
https://blog.zoller.lu/p/tzo-13-2020-avira-generic-av-bypass-zip.html
Vulnerability Dislosure Policy: https://caravelahq.com/b/policy/20949

Affected Products
=================
AV Engine below 8.3.54.138

All Avira products :
- Avira Antivirus Server
- Avira Antivirus for Endpoint
- Avira Antivirus for Small Business
- Avira Exchange Security (Gateway)
- Avira Internet Security Suite for Windows
- Avira Prime
- Avira Free Security Suite for Windows
- Cross Platform Anti-malware SDK

Attention:
Avira does not patch or update their very popular command line scanner 
that is still available for download on their website. Since Avira does 
not release and advisory their customers are none the wiser.

Avira licenses it's engine to many OEM Partners. The OEM Partners that 
use the Avira Engine may be vulnerable or not. I would advise that you 
reach out to the vendors listed below to know whether you are affected 
or not. OEM Partners
can reach out to me to retreive the POC in order to test.

AVIRA OEM Partners:
- F-Secure
- Sophos
- Barracude
- Alibaba Cloud Security
- Check Point
- CUJO AI
- TP-Link
- FujiSoft
- AWS
- Rohde and Schwarz
- Careerbuilder
- Huawei
- Dracoon
- Total Availability
- FixMeStick
- APPVISORY
- Tabidus
- Cyren


Source :
https://oem.avira.com/en/partnership/our-partners


I. Background
----------------------------
Quote: "We protect people—like you—across all devices, both directly and 
via our OEM partnerships.We provide a wide variety of best-in-class 
solutions to enhance your protection, performance,
and online privacy—ranging from antivirus to VPN and cleanup technologies.

A server security should get special attention, as a single employee 
might store a malicious file on the network and instantly cause a 
cascading damage across the entire organization.
With Avira's solutions for server security you can prevent such 
scenarios by protecting your network, data, and web traffic. "

Avira has the Trust Seal or the
http://www.teletrust.de/itsmig/


II. Description
----------------------------
The parsing engine supports the ZIP container format. The parsing engine 
can be bypassed  by specifically manipulating the ZIP Archive (GPFLag)
the Avira parser believes the file to be encrypted although it isn't. 
This leads to the Endpoint ignoring the archive and the Avira Gateway 
Solutions
to follow the "File is encrypted" logic.  By default this blocks the 
attachement.

According to my experience most companies are asking employees to 
encrypt archives when sending them via email. It is hence very likely 
that  passworded ZIP files would be allowed through the Gateway.

For these customers, this exploit will bypass the Gateway by leading it 
into the wrong logic path believing the file is encrypted. 7ZIP
extracts the file without prompt.

Avira argues that "In this case our product reacts as planned and 
defined in our product, we only support standard conform file types in 
this case, if the file header shows an encrypted file, we will not try 
unpack it. Using a gateway protection without using an endpoint 
protection cannot be taken into consideration as it violates common 
known standards like the defense in depth strategy."

In my experience companies are mixing AV vendors to increase the 
Detection rate. It should be quite common to not have Avira on the 
Endpoint if it
is used in the Gateway, there is no guarantee that this Endpoint would 
detect the sample that bypassed Avira on the Gateway.

However Avira doesn't believe so assuming all customers also have their 
Endpoint solution installed.

I tried to explain the threat model by refering to their own Website 
which claims that detection on servers is indeed very important
""Daher sollte auf Server-Sicherheit ein besonderes Augenmerk gerichtet 
werden – wenn nur ein einziger Mitarbeiter eine schädliche Datei im 
Netzwerk speichert, kann dadurch im gesamten Unternehmen eine fatale 
Kettenreaktion ausgelöst werden. Mit Aviras Lösung für Server-Sicherheit 
können Sie solche Szenarien verhindern und Ihr Netzwerk, Ihre Daten und 
Ihren Datenverkehr im Internet schützen.""


Weird discussions took place after that with Avira arguing that "Defence 
in Depth" is a default security strategy that customers should have, I 
am going to spare you that discussion.

In Summary: Avira has not patched this flaw (contrary to other Vendors). 
All CLient-side products (incldugin servers) will ignore the archive
and not scan it's contents. In case you believe you want AVIRA to focus 
on providing most coverage possible feel free to reach out to them. If 
you are an OEM partner I suggest you do the same.

III. Impact
----------------------------
Impacts depends on the contextual use of the product and engine within 
the organisation
of a customer. Gateway Products (Email, HTTP Proxy etc) may allow the 
file through unscanned
and give it a clean bill of health. Server side AV software will not be 
able to discover
any code or sample contained within this ISO file and it will not raise 
suspicion even
if you know exactly what you are looking for (Which is for example great 
to hide your implants
or Exfiltration/Pivot Server).

There is a lot more to be said about this bug class, so rather than bore 
you with it in
this advisory I provide a link to my 2009 blog post
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

IV. Patch / Advisory
----------------------------
I advise customers on scancl.exe (or Unix Variant) to change to another 
vendor as Avira
is apparently no longer maintaining it, and apparently also not warning 
customers about
vulnerabilities

Furthermore should be be an enterprise customer of the OEM Partners 
above I suggest to
reach out to the vendor in order to understand whether this flaw was 
patched downstream
in their respective products.

I recommend to the amavisd project to warn users of this facts
https://gitlab.com/amavis/amavis/blob/master/amavisd.conf


In case you have any further questions please direct them to Avira, the 
above is based on
the best of my knowledge and since AVIRA does not release Advisories we 
are left in the dark
as to what they officially recommend.

V. Disclosure timeline
----------------------------

How Avira handled these reports in 2009 :
https://blog.zoller.lu/2009/04/avira-antivir-generic-cab-bypass.html

The below is a summary of 2-3 evasion reports that I have submitted.

See [TZO-001-2020] Avira for the overall coordination timeline, here is
the specific.

04-12-2019
"For our point of view this is an attack with a very low probability.

Gateway does not check encrypted files
In this case our product reacts as planned and defined in our product, 
we only support standard conform file types in this case, if the file 
header shows an encrypted file, we will not try unpack it.
In the further process the above mentioned conditions must be taken into 
consideration, which lowers the attack vector further.

Using a gateway protection without using an endpoint protection cannot 
be taken into consideration as it violates common known standards like 
the defense in depth strategy.

All in all I am sorry, but we will stay with our decision, which means, 
that we will not handle this as a vulnerability."

Editors note: AVIRA is arguing on "probability" which is risk 
management, that's fine for customers, but as Avira does not know the 
context
in which the customer is using the product it cannot rate the risk for 
thousands of enterprise customers. That's why generally, vulnerability
coordination focuses on the technical aspects and does not go into 
"probability" factors.

04-12-2019
- Avira closes the reports

05-12-2019
I reply with
"First you assume it is only 7zip it isn't. I only use 7zip because it 
is the most used in my experience within enterprises.
"if the file header shows an encrypted file" -> the archive is not encrypted
You have not taken into account at all that your customers will need to 
set the rule set to PASS on encrypted files leaving this UNENCRYPTED 
file unscanned. You could scan it but you choose not to, so this is 
bypassing your GW protection logic - which you seem not take into account.
You assume your customers have your endpoint solution installed, that is 
not necessarely the case, actually I would argue the opposite, more 
often than not. Regardless of the rationale above you already set it to 
not applicable. As discussed and agreed beforehand I will hence proceed 
to publish an advisory on the matter."

Quick Addendum : To talk to my "risk management point". You are talking 
about "probability", probability of occurence is for your customers to 
determine based on their use case and policy, during risk management. 
The probability that someone will use this method is actually high. Why 
? The costs of doing so (swapping a byte) is very low and the gain is high.

You made the wrong call, you should have changed your gateway logic and 
patch the vuln.

05-12-2019
Aviras reply "As discussed and agreed you can move on with the 
disclosure process.
We would kindly ask you for a quick note in the moment you publish the 
article."

05-12-2019 I request a list of affected products " I'd need a list of 
affected products from you. Any advice to customers on how to configure 
the product or any other mitigations?"

05-12-2019
Avira: "can you please clarify the usage of both?
Would these answers be publicly disclosed"

Editors Note: Didn't we just agree that I publish an advisory a few 
hours before ?

09-12-2019:
Avira replys, but does not provide a list of affected products.
The reply :
"Which software products are affected?
The feature of unpacking this highly manipulated und corrupted Zip file is
missing in all our consumer products, as our customers are protected by 
the real
time protection.

The Avira Exchange Security product will handle a mail with such a file 
attached
automatically in the "bad mail process", which is default assigned to 
send all
tagged mails to an administrator, but can be configured by the owner.

Mitigations/ Configuration advices:
For customers using our endpoint protection we recommend to not switch off
the real time protection, which is enabled by default."

09-12-2019
I wanted to make sure there is no misunderstanding, as a lot of 
components have effectively no "on access" scanner capability (Gateway, 
Cloud, Server)

"Thanks a lot, after reading throught this I have 2 Comments :

Can you double check for Avira Exchange? That is not the case, it will 
go into the "Encrypted file" liogic and follow the rule set for 
passworded files.
Have you consiedered your SMB range of products ? Especially Server, any 
further recommendations there? https://www.avira.com/de/server-security 
- Quote "Schutz für Datei-Server. Schützt alle auf Ihren Servern 
gespeicherten Daten vor Malware.""


09-12-2019
I follow up:
"The problem is that it won't have the same workflow in 95% of the cases 
as passworded files are mostly whitelisted. Which was my point in the 
report.
Files on servers are often stored and not executed, real time protection 
doesn't help alot in this particular case."

09-12-2019
Avira replies:

to comment 1:
In this case it would mean, that an owner decided to differ from the 
default and recommended configuration, which moves the layer of 
protection from the gateway to the endpoint protection. Which leads us 
to the point of "real time protection".

to comment 2:
So to be 100% accurate about that, we are talking about a manipulated 
zip file, which is stored on a share drive in the local area network, 
which I as a user can access and copy the file from to my local device?
OR We are talking about a manipulated zip file, which is stored in a 
share drive in the local area network, which I can access and unzip my 
file to? (So the share is not ready only?)


09-12-2019
My reply:s
"I have given presentations about this around 2011 - Rarely the same AV 
solution is used on the endpoint than on the Gateway (reasons are 
obvious you are most likely to detect more). In a scenario where avira 
would have detected the sample but symantec (endpoint) not you have 
failed to protect the customer. In addition we are usually talking about 
security goals of a product that fails or doesn't. Justifying that one 
product fails but another one would catch it is mudding the water and 
simply inconsistent. The security promises and goals are not true any 
longer. You cannot rely on your customer having other mitigations, 
that's also not what you promise customers of your GW product.

You use one example when there are hundreds. If I would be an APT i 
would store my stash isnide such a zip file since it can't be parser it 
won't be detected and stay dormant, EVEN if detection routines exist in 
DLP/AV product.

Whatever the protocol is, SMB, FTP, HTTP, CFIS. File is stored on server 
and processed remotely automatically or by a user. That is the reason we 
invest in server side AV. Which seems also to be the promise made to 
customers.

"Daher sollte auf Server-Sicherheit ein besonderes Augenmerk gerichtet 
werden – wenn nur ein einziger Mitarbeiter eine schädliche Datei im 
Netzwerk speichert, kann dadurch im gesamten Unternehmen eine fatale 
Kettenreaktion ausgelöst werden. Mit Aviras Lösung für Server-Sicherheit 
können Sie solche Szenarien verhindern und Ihr Netzwerk, Ihre Daten und 
Ihren Datenverkehr im Internet schützen."


10-12-2019

taking all your arguments in consideration we decided, that we will not 
investigate any further on this special case, as we do not accept your 
argumentation regarding an increased attack vector or an increased risk. 
The risk of this file is the same risk as of files being encrypted by
a password and storing the password in a text file next to the zipped file.

Regarding your comments we will stay with our argumentation, that a 
security approach and the mitigation of risk should not be based on one 
single layer of protection (Defense in Depth).

The following definition of these approach shows our argumentation in 
more details,
which we would highly recommend to take into consideration, especially 
if APT
attacks are part of your personal threat landscape.

Defense-in-Depth
"Information security strategy integrating people, technology, and 
operations capabilities to establish variable barriers across multiple 
layers and missions of the organization."
[Bill Bonney, Gary Hayslip, Matt Stamper: CISO Desk Reference Guide 
Volume 2, 2018]

Quoting the a white-paper published by the Department of Homeland 
Security in September 2016:

"An organization's cybersecurity strategy should protect the assets that it
deems critical to successful operation. Unfortunately, there are no 
shortcuts,
simple solutions, or "silver bullet" implementations to solve cybersecurity
vulnerabilities within critical infrastructure [...]. It requires a layered
approach known as Defense in Depth."
Department of Homeland Security, September 2016

We will close this ticket for now.

Thank you for contacting us and feel free to reach us with in case of 
any further findings or reports.

10-12-2019
My reply:
With all due respect, I am not discussing security strategies I am 
reporting vulnerabilities. I also don't think I need to be lectured on 
these. You are running a product vulnerability coordination program not 
an incident response program or risk management program in a company. 
Per definition this is a vulnerability.

You have not understood the threat model and keep talking about "risks". 
When I argue about Enterprise usage of your software you start to argue 
that APT is not part of my "personal" threat landscape.

I am giving up on this one and will let your customers decide. I 
understand you have no further recommendation for your enterprise 
customers using your server side protection."

21-12-2019
I realise that I have still not receive the list of affected products
"You have no answered my request for the list of affected products, I 
need a list of products that are affected if you want to respect our 
previous agreement and continue collaboration."

21-12-2019
"I provided an answer to that in my post from the 09 Dec 2019 15:20:42 UTC."
Note: They didn't (see above)

22-12-2019
"You have not provided an answer - I need a list of products (Server, 
Gateway, Client-side) that are unable to parse the archive.
You are talking about a gateway only."

No reply

13.02.2020
Release of this advisory.

Powered by blists - more mailing lists