full-disclosure - Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050316010706.GW1645@suespammers.org>
From: rodrigob at suespammers.org (Rodrigo Barbosa)
Subject: Unfiltered escape sequences in filenames
	contained in ZIP archives wouldn't be escaped on displaying or
	logging, and can also lead to bypass AV scanning

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Mar 15, 2005 at 09:06:05PM +0000, Nigel Horne wrote:
> > > # unzip -l mixed-eicar.zip
> > > Archive:  mixed-eicar.zip
> > >  Length     Date   Time    Name
> > > --------    ----   ----    ----
> > >      308  03-10-05 12:00   Test^G^[[2J^[[2;5m^[[1;31mHACKER
> > > ATTACK^[[2;25m^[[22;30m^[[3q.txt
> > >      308  03-10-05 12:00   eicarcom2.zip
> > > --------                   -------
> > >      616                   2 files
> > 
> > F-Prot seems to detect it correctly:
> 
> As does clamAV:
> [njh@njh tmp]$ clamscan mixed-eicar.zip
> mixed-eicar.zip: Eicar-Test-Signature FOUND
> 
> Scanned files: 1
> Infected files: 1

Actually, no. There were 2 infected files in there. ClamAV only found 1.

[]s

- -- 
Rodrigo Barbosa <rodrigob@...spammers.org>
"Quid quid Latine dictum sit, altum viditur"
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFCN4a6pdyWzQ5b5ckRAj+3AJ9fucP7IbUuizPfy16+CRJvHYqLqwCcDwGV
xV1vW8Fgb4dqLSqODra4W78=
=DTMF
-----END PGP SIGNATURE-----