bugtraq - Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061207151550.536082b7@Wierszokleta>
Date: Thu, 7 Dec 2006 15:15:50 +0100
From: Tomasz Kojm <tkojm@...mav.net>
To: Hendrik Weimer <hendrik@...o.de>
Cc: bugtraq@...urityfocus.com, info@...persky.com, info@...ecure.com
Subject: Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass

On Wed, 06 Dec 2006 15:24:25 +0100
Hendrik Weimer <hendrik@...o.de> wrote:

> Several e-mail virus scanners can be tricked into passing an EICAR
> test file if the following conditions are met:
> 
> 1. the EICAR file is encoded in Base64 including characters not in the
>    standard alphabet (e.g. whitespaces) and
> 2. the part containing the EICAR file is nested within one or several
>    levels of multipart/mixed content.
> 
> Details and PoC can be found at:
> http://www.quantenblog.net/security/virus-scanner-bypass

That's _extremely_ irresponsible to disclose bugs without giving the vendors
any chance to fix them and prepare new software releases.

-- 
   oo    .....         Tomasz Kojm <tkojm@...mav.net>
  (\/)\.........         http://www.ClamAV.net/gpg/tkojm.gpg
     \..........._         0DCA5A08407D5288279DB43454822DC8985A444B
       //\   /\              Thu Dec  7 15:13:35 CET 2006