bugtraq - Re: eSafe: Could this be exploited?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1090765495.6239.2.camel@localhost.localdomain>
Date: Sun, 25 Jul 2004 17:24:55 +0300
From: "Andreas Constantinides (MegaHz)" <megahz@...ahz.org>
To: 3APA3A <3APA3A@...URITY.NNOV.RU>
Cc: Hugo van der Kooij <hvdkooij@...derkooij.org>,
	bugtraq@...urityfocus.com
Subject: Re: eSafe: Could this be exploited?


which version of eSafe are we talking about? 3 or 4 ?

On Sat, 2004-07-24 at 14:27, 3APA3A wrote:
> Dear Hugo van der Kooij,
> 
> --Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq@...urityfocus.com:
> 
> HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the
> HvdK> end-user before they stop a virus. Then they rely on the adding of the
> HvdK> exact URL so that URL can be blocked in all next requests.
> 
> It depends on how antiviral check is actually implemented. If connection
> is  broken  immediately after signature is detected - there is no way to
> download  infected  file,  because signature will not pass to client and
> client  will  not  be  able  to  use "Range:" header to resume partially
> downloaded  file.
> 
> If  antiviral  filter  checks data _after_ all data received from client
> with  20%  buffering  yes,  it's possible to bypass this check for HTTP,
> because  there  is  no  way  (at least for HTTP/1.0 and FTP) to indicate
> error to client and make him to delete partially downloaded data.
> 
> You can check it, by sending EICAR with some additional data: if you can
> find  EICAR  signature  on  the  client  after  connection  is broken by
> antiviral filter you can bypass it's protection.
>