Dr. Peter Bieringer
14/03/05, 23:45
--==========166ADC26FEA8CCC3A087==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Hello,
during investigation of Sober.l we got the idea to replace the spaces of a=20
filename contained in the ZIP archive by some escape sequences.
Many AV software is logging such filenames during decompressing, so after=20
creating such regular ZIP archive (by using Perl Archive::Zip module, no=20
other tweaks!) we've found that some of the tested products do not filter=20
or replace the escape sequences, which leads to funny results during=20
displaying the output of the AV scanner or viewing the log.
Also we found that at least 2 AV scan programs from 2 vendors do not detect =
the virus inside and report "clean" instead.
See here for more details:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/unfiltered-=
escape-sequences.txt>
<http://www.aerasec.de/security/index.html?id=3Dae-200503-020&lang=3Den>
We provide also samples and the Perl program for creating the samples:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/>
Due lack of time we only tested a few products, so if one can provide=20
results of other products, pls. send them (also) to us. Thank you!
Regards,
Dr. Peter Bieringer
--=20
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Strasse 1 Mobile: +49-174-9015046
D-85662 Hohenbrunn E-Mail: pbieringer@aerasec.de
Germany Internet: http://www.aerasec.de
--==========166ADC26FEA8CCC3A087==========
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
iD8DBQFCNZ3eznfbvpHmKq4RAmaeAJwKtH5BmoV9vx+55Ubdkv qsQ+APaACfcN6z
EowmowjZjy4XK7nQ2xHoEY4=
=jBp7
-----END PGP SIGNATURE-----
--==========166ADC26FEA8CCC3A087==========--
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Hello,
during investigation of Sober.l we got the idea to replace the spaces of a=20
filename contained in the ZIP archive by some escape sequences.
Many AV software is logging such filenames during decompressing, so after=20
creating such regular ZIP archive (by using Perl Archive::Zip module, no=20
other tweaks!) we've found that some of the tested products do not filter=20
or replace the escape sequences, which leads to funny results during=20
displaying the output of the AV scanner or viewing the log.
Also we found that at least 2 AV scan programs from 2 vendors do not detect =
the virus inside and report "clean" instead.
See here for more details:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/unfiltered-=
escape-sequences.txt>
<http://www.aerasec.de/security/index.html?id=3Dae-200503-020&lang=3Den>
We provide also samples and the Perl program for creating the samples:
<ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/>
Due lack of time we only tested a few products, so if one can provide=20
results of other products, pls. send them (also) to us. Thank you!
Regards,
Dr. Peter Bieringer
--=20
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Strasse 1 Mobile: +49-174-9015046
D-85662 Hohenbrunn E-Mail: pbieringer@aerasec.de
Germany Internet: http://www.aerasec.de
--==========166ADC26FEA8CCC3A087==========
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
iD8DBQFCNZ3eznfbvpHmKq4RAmaeAJwKtH5BmoV9vx+55Ubdkv qsQ+APaACfcN6z
EowmowjZjy4XK7nQ2xHoEY4=
=jBp7
-----END PGP SIGNATURE-----
--==========166ADC26FEA8CCC3A087==========--