full-disclosure - Multiple AV Vendor Incorrect CRC32 Bypass Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050310023652.61466.qmail@web31502.mail.mud.yahoo.com>
From: visitbipin at yahoo.com (bipin gautam)
Subject: Multiple AV Vendor Incorrect CRC32 Bypass
	Vulnerability.

Multiple AV Vendor Incorrect CRC32 Bypass
Vulnerability.

Affected Product:
AVG 718
Sybari (Antigen for M$ exchange) 7.5.1314
Symantec 8.0
McAfee 4442
BitDefender 7.0

Description:
if you create a zip archive with invalid CRC
checksum...... some AV skip scanning the archive
marking it as clean........ by this way, you can
bypass antivirus gateways and slip in any attachment
without scanning the archive. Moreover, these days....
software tools automatically repair a *broken*
archive.

Vendor notification: I've lost faith in responsible
disclosure... long ago! Moreover, vendors don't
respond in timely manner.

regards,
Bipin Gautam
http://www.geocities.com/visitbipin/

Disclaimer: The information in the advisory is
believed to be accurate at the time of printing based
on currently available information. Use of the
information constitutes acceptance for use in an AS IS
condition. There are no warranties with regard to this
information. Neither the author nor the publisher
accepts any liability for any direct, indirect or
consequential loss or damage arising from use of, or
reliance on this information.

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com