full-disclosure - Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through forged magic byte

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu Oct 27 09:02:58 2005
From: James.Williams at ca.com (Williams, James K)
Subject: Re: Multiple Vendor Anti-Virus Software Detection
	Evasion Vulnerability through forged magic byte

> Subject: Re: Multiple Vendor Anti-Virus Software Detection 
> Evasion Vulnerability through forged magic byte
> From: "Andrey Bayora" <andrey () securityelf ! org>
> Date: 2005-10-25 3:07:51
>
> [...]
>
> VULNERABLE vendors and software (tested):
>
> [...]
>
> 3.  eTrust CA (ver 7.0.1.4, engine 11.9.1, vir sig. 9229)
>
> [...]
> DESCRIPTION:
>
> The problem exists in the scanning engine - in the routine that
> determines the file type. If some file types (file types tested
> are .BAT, .HTML and .EML) changed to have the MAGIC BYTE of the 
> EXE files (MZ) at the beginning, then many antivirus programs 
> will be unable to detect the malicious file. It will break the 
> normal flow of the antivirus scanning and many existent and 
> future viruses will be undetected.

Andrey,

Thank you for the report.  

You are effectively altering existing viruses to the point that 
AV scanners do not detect them.  If your altered virus sample 
still executes correctly, you have simply created a new virus 
variant.  If your altered virus sample does not execute properly, 
you have created nothing more than a corrupt virus sample.

Consequently, the issue that you describe is *not* a 
vulnerability issue, but rather just an example of a new variant
that has not yet been added to an AV vendor's database of "known
viruses".

Note that CA eTrust Antivirus, when running in Reviewer mode, 
should already detect these new variants.

Regards,
Ken 

Ken Williams ; Dir. Vuln Research 
Computer Associates ; 0xE2941985