full-disclosure - Multi-vendor AV gateway image inspection bypass vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1105729620.5101.22.camel@maze.xs-security.com>
From: trog at uncon.org (Trog)
Subject: Multi-vendor AV gateway image inspection
	bypass vulnerability

Quoting Darren Bounds <dbounds@...rusense.com>:

> Multi-vendor AV gateway image inspection bypass vulnerability
> January 10, 2005
> 
> A vulnerability has been discovered which allows a remote attacker
> to bypass anti-virus
> (as well other security technologies such as IDS and IPS) inspection
> of HTTP image content.
> 
> By leveraging techniques described in RFC 2397 for base64 encoding  
> image content within
> the URL scheme. A remote attack may encode a malicious image within
> thebody of an HTML
> formatted document to circumvent content inspection.

Support for extracting RFC2397 encoded data within HTML documents has
been added to the CVS version of Clam AntiVirus, the open source virus
scanner.

The next stable release containing this feature, version 0.81 is
scheduled to become a Release Candidate on 19th Jan.

Until that time, access to the current development code is available via
CVS and nightly tarballs. See www.clamav.net for download details.

Thanks,
-trog