full-disclosure - Re: Anti-Virus Malformed ZIP Archives flaws [UPDATE]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue Jun 21 01:08:31 2005
From: nknight at runawaynet.com (Nicholas Knight)
Subject: Re: Anti-Virus Malformed ZIP Archives flaws
	[UPDATE]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thierry Zoller wrote:
> Antigen.zip (fake compressed size and uncompressed size values)
> ---------------------------------------------------
> Failed:

<snip>

> McAfee             4513

<snip>

The Antigen.zip test is flawed. The EICAR test file, by definition, is a
maximum of 128 bytes [1]. Technically, it shouldn't even have anything
other than the test string and whitespace in it. McAfee picks it up even
with garbage rather than whitespace after it, but only if it's small
enough (I tested it with the header sizes forged to 127 bytes instead of
255 [2] and McAfee picked it up just fine). Presumably, mindful of the
defined limitations of the EICAR test file, McAfee won't pick up EICAR
in files >128 bytes in order to avoid complications from EICAR appearing
in documents not intended for scanner testing (like [1]).

If you really want to find out if scanners are vulnerable to this,
you'll probably need to use a real virus in the zip.

[1] http://www.eicar.org/anti_virus_test_file.htm

[2] You can find the file I used here:
http://runawaynet.com/~nknight/avt/Antigen-forgedcrc-fixedsize.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org

iD8DBQFCtwzzUsZlh+GmLlQRAgADAKDFBu6gC+LEXVaholDSPqBZ1Vvq8QCdG97m
S+fxK1JfFLRDNa/vQsctTlg=
=Jr2u
-----END PGP SIGNATURE-----