Multiple Antivirus Scanners DoS attack.

[bipin gautam]

Multiple Antivirus Scanners DoS attack.

--- [Vulnerable Products] ---
Only tested on...

* Norton Antivirus 2002
* Norton Antivirus 2003
* Mcafee VirusScan 6
* Network Associates (McAfee) VirusScan Enterprise 7.1
* Windows Xp default ZIP manager [report's wrong size of compress ZIP
files.]

There has been multiple reports [Unconfirmed]
*F-Prot 4.4.2 for Linux
*Panda Antivirus

Are vulnerable.


Risk Impact: Medium

--- [Details] ---

While having a manual scan of compressed files; several Antivirus, Trojan,
Spy ware scanners suffer a DoS attack if the software tries to completely
extract the archive and scan its content for a hostile file.

--- [Proof of Concept] ---
Please download this file.
http://www.geocities.com/visitbipin/SERVER_dwn.zip

Moreover it's not safe to set automatically 'Quarantine/delete' option set
for your AV scanner as it may try to Quarantine the virus by extracting the
archive.

-----------
Bipin Gautam
http://www.geocities.com/visitbipin/

Disclaimer: The information in the advisory is believed to be accurate at
the time of printing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition. There are
no warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect or consequential
loss or damage arising from use of, or reliance on this information.

__________________________________________________ _______________
It's fast, it's easy and it's free. Get MSN Messenger today!
http://www.msn.co.uk/messenger

[Ethy H. Brito]

On Mon, 14 Jun 2004 14:38:50 +0000
"bipin gautam" <visitbipin@hotmail.com> wrote:

> Multiple Antivirus Scanners DoS attack.
>
> --- [Vulnerable Products] ---
> Only tested on...
>
> * Norton Antivirus 2002
> * Norton Antivirus 2003
> * Mcafee VirusScan 6
> * Network Associates (McAfee) VirusScan Enterprise 7.1
> * Windows Xp default ZIP manager [report's wrong size of compress ZIP
> files.]

Linux uvscan scan engine 4.3.20 (MacAfee) is also vulnerable.
uvscan takes all CPU and lots of memory been only killed with signal 9 from another terminal.

from 'top':
PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
1306 nobody 15 0 22744 21M 1648 R 97.4 35.6 0:44 0 uvscan

nobody@babalu:/usr/local/uvscan# ./uvscan -v -r --analyze --unzip BlackHole.zip
Scanning BlackHole.zip
Scanning file BlackHole.zip
Scanning file BlackHole.zip/~.BZ2
..... stalls here .....

--

Ethy H. Brito /"\
InterNexo Ltda. \ / CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
+55 (12) 3941-6860 X ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
S.J.Campos - Brasil / \

[Messer, Jon]

Symantec AV Corporate version 8 doesnt seem to be affected. I scanned the
blackhole.zip file and SAV corp v8 blew right through all levels of the
compression and found and quarantined the EICAR test strings.

-----Original Message-----
From: Ethy H. Brito [mailto:ethy@inexo.com.br]
Sent: Monday, June 14, 2004 10:48 AM
To: bugtraq@securityfocus.com
Subject: Re: Multiple Antivirus Scanners DoS attack.


On Mon, 14 Jun 2004 14:38:50 +0000
"bipin gautam" <visitbipin@hotmail.com> wrote:

> Multiple Antivirus Scanners DoS attack.
>
> --- [Vulnerable Products] ---
> Only tested on...
>
> * Norton Antivirus 2002
> * Norton Antivirus 2003
> * Mcafee VirusScan 6
> * Network Associates (McAfee) VirusScan Enterprise 7.1
> * Windows Xp default ZIP manager [report's wrong size of compress ZIP
> files.]

Linux uvscan scan engine 4.3.20 (MacAfee) is also vulnerable.
uvscan takes all CPU and lots of memory been only killed with signal 9 from
another terminal.

from 'top':
PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
1306 nobody 15 0 22744 21M 1648 R 97.4 35.6 0:44 0 uvscan

nobody@babalu:/usr/local/uvscan# ./uvscan -v -r --analyze --unzip
BlackHole.zip
Scanning BlackHole.zip
Scanning file BlackHole.zip
Scanning file BlackHole.zip/~.BZ2
..... stalls here .....

--

Ethy H. Brito /"\
InterNexo Ltda. \ / CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
+55 (12) 3941-6860 X ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
S.J.Campos - Brasil / \

[Bo Rasmussen]

Hi,

Just tried with clamscan and clamdscan v.0.71 on a OpenBSD 3.5, with
these signatures:

ClamAV update process started at Tue Jun 15 09:13:49 2004
main.cvd is up to date (version: 23, sigs: 21096, f-level: 2, builder:
ddm)
daily.cvd updated (version: 357, sigs: 866, f-level: 2, builder:
ccordes)
Database updated (21962 signatures) from database.clamav.net
(152.66.249.132).


mail# clamscan SERVER_dwn.zip=20
SERVER_dwn.zip: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 21962
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 20.13 MB
I/O buffer size: 131072 bytes
Time: 9.006 sec (0 m 9 s)
mail#

mail# clamdscan SERVER_dwn.zip=20
/var/amavis/SERVER_dwn.zip: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Infected files: 1
Time: 8.053 sec (0 m 8 s)
mail#


No problems whatsoever.


Regards

Bo Rising Rasmussen
it/security consultant
brr@cadesign.dk

> -----Original Message-----
> From: bipin gautam [mailto:visitbipin@hotmail.com]=20
> Sent: Monday, June 14, 2004 4:39 PM
> To: cert@cert.org; bugtraq@securityfocus.com
> Cc: wk@c4i.org; vulndiscuss@vulnwatch.org;=20
> vulndiscuss-owner@vulnwatch.org
> Subject: Multiple Antivirus Scanners DoS attack.
>=20
> Multiple Antivirus Scanners DoS attack.
>=20
> --- [Vulnerable Products] ---
> Only tested on...
>=20
> * Norton Antivirus 2002
> * Norton Antivirus 2003
> * Mcafee VirusScan 6
> * Network Associates (McAfee) VirusScan Enterprise 7.1
> * Windows Xp default ZIP manager [report's wrong size of=20
> compress ZIP files.]
>=20
> There has been multiple reports [Unconfirmed] *F-Prot 4.4.2=20
> for Linux *Panda Antivirus
>=20
> Are vulnerable.
>=20
>=20
> Risk Impact: Medium
>=20
> --- [Details] ---
>=20
> While having a manual scan of compressed files; several=20
> Antivirus, Trojan, Spy ware scanners suffer a DoS attack if=20
> the software tries to completely extract the archive and scan=20
> its content for a hostile file.
>=20
> --- [Proof of Concept] ---
> Please download this file.
> http://www.geocities.com/visitbipin/SERVER_dwn.zip
>=20
> Moreover it's not safe to set automatically=20
> 'Quarantine/delete' option set for your AV scanner as it may=20
> try to Quarantine the virus by extracting the archive.
>=20
> -----------
> Bipin Gautam
> http://www.geocities.com/visitbipin/
>=20
> Disclaimer: The information in the advisory is believed to be=20
> accurate at the time of printing based on currently available=20
> information. Use of the information constitutes acceptance=20
> for use in an AS IS condition. There are no warranties with=20
> regard to this information. Neither the author nor the=20
> publisher accepts any liability for any direct, indirect or=20
> consequential loss or damage arising from use of, or reliance=20
> on this information.
>=20
> __________________________________________________ _______________
> It's fast, it's easy and it's free. Get MSN Messenger today!=20
> http://www.msn.co.uk/messenger
>=20
>=20

[Brian Christmas]

Hello,

Just tried this using PC-Cillin version 11.31 with def file of 1.905.00.


With default settings real-time scan did not detect a virus in the zip
file. Doing a manual scan hosed the PC. Tried to kill pc-cillin
process but was unable to. =20

Next I tested by maxing out the scan layer for both manual and real-time
settings. Real-time detected the EICAR virus but was unable to
quarantine or delete the file. As for the manual scan it again hosed my
PC where the only thing I could do was a hard reboot.

Will test this on Trend Micro's Client/Server/Messaging next.


> -----Original Message-----
> From: bipin gautam [mailto:visitbipin@hotmail.com]=20
> Sent: Monday, June 14, 2004 4:39 PM
> To: cert@cert.org; bugtraq@securityfocus.com
> Cc: wk@c4i.org; vulndiscuss@vulnwatch.org;=20
> vulndiscuss-owner@vulnwatch.org
> Subject: Multiple Antivirus Scanners DoS attack.
>=20
> Multiple Antivirus Scanners DoS attack.
>=20
> --- [Vulnerable Products] ---
> Only tested on...
>=20
> * Norton Antivirus 2002
> * Norton Antivirus 2003
> * Mcafee VirusScan 6
> * Network Associates (McAfee) VirusScan Enterprise 7.1
> * Windows Xp default ZIP manager [report's wrong size of=20
> compress ZIP files.]
>=20
> There has been multiple reports [Unconfirmed] *F-Prot 4.4.2=20
> for Linux *Panda Antivirus
>=20
> Are vulnerable.
>=20
>=20
> Risk Impact: Medium
>=20
> --- [Details] ---
>=20
> While having a manual scan of compressed files; several=20
> Antivirus, Trojan, Spy ware scanners suffer a DoS attack if=20
> the software tries to completely extract the archive and scan=20
> its content for a hostile file.
>=20
> --- [Proof of Concept] ---
> Please download this file.
> http://www.geocities.com/visitbipin/SERVER_dwn.zip
>=20
> Moreover it's not safe to set automatically=20
> 'Quarantine/delete' option set for your AV scanner as it may=20
> try to Quarantine the virus by extracting the archive.
>=20
> -----------
> Bipin Gautam
> http://www.geocities.com/visitbipin/
>=20
> Disclaimer: The information in the advisory is believed to be=20
> accurate at the time of printing based on currently available=20
> information. Use of the information constitutes acceptance=20
> for use in an AS IS condition. There are no warranties with=20
> regard to this information. Neither the author nor the=20
> publisher accepts any liability for any direct, indirect or=20
> consequential loss or damage arising from use of, or reliance=20
> on this information.
>=20
> __________________________________________________ _______________
> It's fast, it's easy and it's free. Get MSN Messenger today!=20
> http://www.msn.co.uk/messenger
>=20
>=20

[Tucker]

Clamav doesnt seems to be affected


tucker@overlink~$ clamscan --version
clamscan / ClamAV version 0.70
tucker@overlink~$ clamscan --verbose SERVER_dwn.zip
SERVER_dwn.zip: Eicar-Test-Signature FOUND

----------- SCAN SUMMARY -----------
Known viruses: 21972
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 26.19 MB
I/O buffer size: 131072 bytes
Time: 30.784 sec (0 m 30 s)


--=20
----------------------------------
Alejandro Perretta
Overlink Soluciones Informaticas
http://www.overlink.net.ar
alejandro@overlink.net.ar
=09Tel. 47998705
Cel. 1554546229=20
----------------------------------
"Si tienes una manzana y yo tengo una manzana y las intercambiamos,=20
entonces tu y yo todav=EDa tendremos una manzana. Pero si tu tienes=20
una idea y yo tengo una idea e intercambiamos esas ideas, entonces=20
cada uno de nosotros tendr=E1 dos ideas."

George Bernard Shaw

In-Reply-To: <BAY17-F32jMdiiRq5jP00147ef0@hotmail.com>

CA eTrust Antivirus 7.0 SP2 scans and detects with no problems.
>
>Multiple Antivirus Scanners DoS attack.
>
>--- [Vulnerable Products] ---
> Only tested on...
>
>* Norton Antivirus 2002
>* Norton Antivirus 2003
>* Mcafee VirusScan 6
>* Network Associates (McAfee) VirusScan Enterprise 7.1
>* Windows Xp default ZIP manager [report's wrong size of compress ZIP
>files.]
>
>There has been multiple reports [Unconfirmed]
>*F-Prot 4.4.2 for Linux
>*Panda Antivirus
>
>Are vulnerable.
>
>
>Risk Impact: Medium
>
>--- [Details] ---
>
>While having a manual scan of compressed files; several Antivirus, Trojan,
>Spy ware scanners suffer a DoS attack if the software tries to completely
>extract the archive and scan its content for a hostile file.
>
>--- [Proof of Concept] ---
>Please download this file.
>http://www.geocities.com/visitbipin/SERVER_dwn.zip
>
>Moreover it's not safe to set automatically 'Quarantine/delete' option set
>for your AV scanner as it may try to Quarantine the virus by extracting the
>archive.
>
>-----------
>Bipin Gautam
>http://www.geocities.com/visitbipin/
>
>Disclaimer: The information in the advisory is believed to be accurate at
>the time of printing based on currently available information. Use of the
>information constitutes acceptance for use in an AS IS condition. There are
>no warranties with regard to this information. Neither the author nor the
>publisher accepts any liability for any direct, indirect or consequential
>loss or damage arising from use of, or reliance on this information.
>
>__________________________________________________ _______________
>It's fast, it's easy and it's free. Get MSN Messenger today!
>http://www.msn.co.uk/messenger
>
>

[Jacek Osiecki]

On Wed, 16 Jun 2004, Tucker wrote:

> Clamav doesnt seems to be affected

> tucker@overlink~$ clamscan --version
> clamscan / ClamAV version 0.70
> tucker@overlink~$ clamscan --verbose SERVER_dwn.zip
> SERVER_dwn.zip: Eicar-Test-Signature FOUND

Same on my clamav.

I have also checked the latest F-Prot for Windows - it scans the file for
quite a long time, but finally does not crash and detects the virus
signature.

Greetz,
--
Jacek Osiecki
joshua@ceti.pl

[Yosif Sleman]

Solaris 8 box with Virus Scan for Solaris 4.32.0, engine 4.3.20 and data
file 4366 takes a lot of CPU and time to process the file, but the process
never crashed neither hanged, the CPU was around 96% of usage, and the
memory kept between 26 and 33MB (i have two webservers an a database
running on the test box and none was affected even with the uvscan taking
all the CPU).

At first, the scan stalled at the same point than Linux but after 3 mins
the scan continued without problems, i had to stop the scan 48 mins later
only with a 50% of the backdoor file processed because it was taking so
long to finish. (the cab files are the slowest to parse).

Regards,
Sleman

At 02:48 PM 14/06/2004 -0300, "Ethy H. Brito" <ethy@inexo.com.br> wrote:
>On Mon, 14 Jun 2004 14:38:50 +0000
>"bipin gautam" <visitbipin@hotmail.com> wrote:
>
> > Multiple Antivirus Scanners DoS attack.
> >
> > --- [Vulnerable Products] ---
> > Only tested on...
> >
> > * Norton Antivirus 2002
> > * Norton Antivirus 2003
> > * Mcafee VirusScan 6
> > * Network Associates (McAfee) VirusScan Enterprise 7.1
> > * Windows Xp default ZIP manager [report's wrong size of compress ZIP
> > files.]
>
>Linux uvscan scan engine 4.3.20 (MacAfee) is also vulnerable.
>uvscan takes all CPU and lots of memory been only killed with signal 9
>from another terminal.
>
>from 'top':
> PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND
>1306 nobody 15 0 22744 21M 1648 R 97.4 35.6 0:44 0 uvscan
>
>nobody@babalu:/usr/local/uvscan# ./uvscan -v -r --analyze --unzip
>BlackHole.zip
>Scanning BlackHole.zip
>Scanning file BlackHole.zip
>Scanning file BlackHole.zip/~.BZ2
> ..... stalls here .....
>
>--
>
>Ethy H. Brito /"\
>InterNexo Ltda. \ / CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
>+55 (12) 3941-6860 X ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
>S.J.Campos - Brasil / \

[Jason Haar]

On Thu, Jun 17, 2004 at 08:50:49AM +0200, Jacek Osiecki wrote:
> I have also checked the latest F-Prot for Windows - it scans the file for
> quite a long time, but finally does not crash and detects the virus
> signature.

Aren't we missing the point here? If I can construct a ~10K file that causes
an AV to hang for 20 mins+ - and I send 50 of them at your server - then
*even if they have no virus in them*, they will DoS you.

Isn't the solution that AVs need to have "resource limits" - where you as
the admin get to set:

* the max size that a file can be expanded to
* the max recursions you will do
* the max time you are willing to spend scanning a message (that would be
hard - becomes a bit of a loop when under load..)
* the max memory you are willing to let your AV grow to

and if any of those conditions are exceeded, then the AV must block-and-exit
(perhaps with a "DoS" descriptor). That way larger sites who are willing to
throw more hardware at this problem can have larger limits - basically you
can set those values to match your environment.


--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1