full-disclosure - another filename bypass vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1256439405.20051117214419@Zoller.lu>
Date: Thu Nov 17 20:44:31 2005
From: Thierry at Zoller.lu (Thierry Zoller)
Subject: another filename bypass vulnerability -
	fromcmd.exe

Dear Morning Wood,

As shown by the recent MZ header bypass, (most) AV "analyse" the header
to determine the Filetpye. I think extension based recognition is to be
considered outdated.

MW> I think the OP was getting at this being an AV bypass vector for worms and
MW> other malware that can interact with cmd.exe .
Hmm ok, but how can it interact when it doesn't execute using explorer.exe ? Is
the user going under Dos to execute it? How does that fit in the
scenario ?

-- 
http://secdev.zoller.lu
Thierry Zoller