bugtraq - RE: Av issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F6BD8B44AF9F843B507FA787AAD1D2D559C71@WAI01.dc.wittig.com>
Date: Mon, 14 Mar 2005 14:11:59 -0500
From: "David Webster" <dwebster@...tig.com>
To: <bugtraq@...urityfocus.com>
Subject: RE: Av issues

Symantec Corporate AV client v 9.0.3.1000 with virus defs 3/9/2005 rev.
32 detected ICAR test string in the zip file listed in the poc url.

-----Original Message-----
From: Bipin Gautam [mailto:visitbipin@...mail.com] 
Sent: Saturday, March 12, 2005 4:40 AM
To: bugtraq@...urityfocus.com
Subject: Av issues

In-Reply-To: <20050311203150.17236.qmail@....securityfocus.com>

In Local file header if you modify "general purpose bit flag" 7th & 8'th
byte of a zip archive with \x2f ie: "\" F-port, Kaspersky, Mcafee,
Norman, Sybari, Symantec seem to skip the file marking it as clean!!!
This was discovered during the analysis of "Multiple AV Vendor Incorrect
CRC32 Bypass Vulnerability."
Quick/rough conclusion were drawn using www.virustotal.com

poc: http://www.geocities.com/visitbipin/gpbf.zip

Well, tested with F-prot, DrWeb, *Symantec 8.0 long ago... lately
verified it using virustotal.com If you have a long archive coment... in
a zip archive these AV can't detect virus embedded in it. I came to know
Symantec 8.1 is immune to the bug?

POC: http://www.geocities.com/visitbipin/long_coment.zip

regards,
bipin gautam