full-disclosure - Multiple AV Vendor Incorrect CRC32 Bypass Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: fcharpen at xmcopartners.com (Frederic Charpentier)
Subject: Multiple AV Vendor Incorrect CRC32
	Bypass	Vulnerability.

Hi, I saw this behaviour last week with the virus "MyDoom.BE".
I use the mail gateway with Clamav/Amavis. Clamav doesn't detect the 
virus embeded in the zip file (with a crc broken).
But, Trendmicro detects it.

Fred.

bipin gautam wrote:
> Multiple AV Vendor Incorrect CRC32 Bypass
> Vulnerability.
> 
> Affected Product:
> AVG 718
> Sybari (Antigen for M$ exchange) 7.5.1314
> Symantec 8.0
> McAfee 4442
> BitDefender 7.0
> 
> 
> Description:
> if you create a zip archive with invalid CRC
> checksum...... some AV skip scanning the archive
> marking it as clean........ by this way, you can
> bypass antivirus gateways and slip in any attachment
> without scanning the archive. Moreover, these days....
> software tools automatically repair a *broken*
> archive.
> 
> Vendor notification: I've lost faith in responsible
> disclosure... long ago! Moreover, vendors don't
> respond in timely manner.
> 
> regards,
> Bipin Gautam
> http://www.geocities.com/visitbipin/
> 
> 
> Disclaimer: The information in the advisory is
> believed to be accurate at the time of printing based
> on currently available information. Use of the
> information constitutes acceptance for use in an AS IS
> condition. There are no warranties with regard to this
> information. Neither the author nor the publisher
> accepts any liability for any direct, indirect or
> consequential loss or damage arising from use of, or
> reliance on this information.
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://www.secunia.com/
> 


-- 
_______________________________________
Frederic Charpentier - Xmco Partners
Security Consulting / Pentest
web  : http://www.xmcopartners.com