bugtraq - Re: Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <EE2F558C4BEF13566E873C09@[10.3.62.6]>
Date: Tue, 15 Mar 2005 17:45:58 +0100
From: "Dr. Peter Bieringer" <pbieringer@...asec.de>
To: bipin gautam <visitbipin@...oo.com>,
	full-disclosure@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: Re: Unfiltered escape sequences in filenames
	contained in ZIP archives wouldn't be escaped on displaying or logging,
	and can also lead to bypass AV scanning




--On Dienstag, 15. März 2005 08:34 -0800 bipin gautam 
<visitbipin@...oo.com> wrote:

> I STIL FIND IT happy to
> see there are lot of AV out there that cant scan such
> file properly to detect virus.

The problem must be located in the unzip engine:

We've created a mixed ZIP now:

# unzip -l mixed-eicar.zip
Archive:  mixed-eicar.zip
  Length     Date   Time    Name
 --------    ----   ----    ----
      308  03-10-05 12:00   Test^G^[[2J^[[2;5m^[[1;31mHACKER 
ATTACK^[[2;25m^[[22;30m^[[3q.txt
      308  03-10-05 12:00   eicarcom2.zip
 --------                   -------
      616                   2 files


BTW: note here that "unzip" displays the escape sequences very proper!

Available here:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/mixed-eicar.zip>

Some AV software detect the virus only in second part of the ZIP file, so 
it looks like the first one is really skipped and not analysed.

	Peter
-- 
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Strasse 1                          Mobile: +49-174-9015046
D-85662 Hohenbrunn                       E-Mail: pbieringer@...asec.de
Germany                                Internet: http://www.aerasec.de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://www.secunia.com/