Anti-Virus Malformed ZIP Archives flaws [UPDATE]

[Thierry Zoller]

Dear List,

3 month have passed since it has been reported that some AntiVirus
engines have flaws in regards to scanning malformed ZIP archives.
This is an update on the situation and hopefully a wake up call
for some vendors.

3 month have passed and a few Anti-Virus engines _still_ are
"vulnerable" to this flaw. They either fail to detect the EICAR
string or Sober (worm) correctly in malformed ZIP archives. It should be
noted the malformed ZIP Archives open up correctly using common
ZIP tools.

Original Advisory :
ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/
2005 AERAsec Network Services and Security GmbH - Dr. Peter Bieringer

http://bipin.sosvulnerable.net/crc.html
Several Other flaws in Regards to malformed ZIP Archives.

My Anti-Virus Results from 15/03/2005 :
http://seclists.org/lists/fulldisclosure/2005/Mar/0556.html


Details as of 14/06/2005
************************

Products tested using
http://www.virustotal.com & http://virusscan.jotti.org/ :

AntiVir 6.31.0.5
AVG 718
Avira 6.31.0.5
BitDefender 7.0
ClamAV devel-20050501
DrWeb 4.32b
eTrust-Iris 7.1.194.0
eTrust-Vet 11.9.1.0
Fortinet 2.32.0.0
Ikarus 2.32
Kaspersky 4.0.2.24
McAfee 4513
NOD32v2 1.1139
Norman 5.70.10
Panda 8.02.00
Sybari 7.5.1314
Symantec 8.0
TheHacker 5.8-3.0
VBA32 3.10.3
ArcaVir
Avast
F-Prot Antivirus

no-escape-sequences-in-filename-eicar.zip
------------------------------------------
Anti-Virus products which failed this test :
Ikarus 2.32 updated on 06.14.2005
Symantec 8.0 updated on 06.13.2005

no-escape-sequences-in-filename-sober.l.zip
------------------------------------------
Failed :
Ikarus 2.32 updated 06.14.2005

unfiltered-escape-sequences-in-filename-eicar.zip
-------------------------------------------------
Failed :
Symantec 8.0
TheHacker 5.8-3.0
Ikarus 2.32

unfiltered-escape-sequences-in-filename-sober.l.zip
---------------------------------------------------
Failed :
TheHacker 5.8-3.0
Ikarus 2.32
AVG (ONLY ON JOTTI, Test done multiple times)

mixed2-eicar.zip AND mixed3-eicar.zip
---------------------------------------------------
Failed:
Symantec 8.0
TheHacker 5.8-3.0
Ikarus 2.32

mixed4-eicar.zip AND mixed-eicar-1.zip
---------------------------------------------------
Failed:
Ikarus 2.32

eicarcom2.zip
---------------------------------------------------
No Failures.

crc.zip (malformed CRC checksum)
---------------------------------------------------
Failed :
Symantec 8.0
NOD32 (ONLY ON JOTTI, Test done multiple times
VirusTotal gives : incorrect CRC checksum, the file may be
damaged)

gpbf.zip (general purpose bit flag hack)
---------------------------------------------------
Failed:
F-Prot Antivirus
Norman Virus Control (Jotti and VirusTotal)
ArcaVir
Symantec

long_coment.zip (long archive comment)
---------------------------------------------------
Failed :
Avast
AVG Antivirus
Symantec 8.0
DrWeb (Failed on VirusTotal, successfull on Jotti)


Antigen.zip (fake compressed size and uncompressed size values)
---------------------------------------------------
Failed:
AntiVir
ArcaVir
Avast
BitDefender
ClamAV
Dr.Web
Fortinet
NOD32
Norman Virus Control
VBA32
Sybari 7.5.1314
Symantec 8.0
TheHacker 5.8-3.0
VBA32 3.10.3
McAfee 4513
eTrust-Iris 7.1.194.0
eTrust-Vet 11.9.1.0

(It should be noted that in order to really use this flaw to hide
malware the CRC value should be corrected AFTER changing the
compressed and uncompressed sizes)


eicar_com ♫?↔▲§ .com .zip ( test_nav.zip)
----------------------------------------------------
Failed:
ClamAV
F-Prot Antivirus
Fortinet
Norman Virus Control

VirusTotal never managed to show the result for this file.



Regards,
Thierry Zoller
mailto:Thierry@sniff-em.com

[Nicholas Knight]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thierry Zoller wrote:
> Antigen.zip (fake compressed size and uncompressed size values)
> ---------------------------------------------------
> Failed:

<snip>

> McAfee 4513

<snip>

The Antigen.zip test is flawed. The EICAR test file, by definition, is a
maximum of 128 bytes [1]. Technically, it shouldn't even have anything
other than the test string and whitespace in it. McAfee picks it up even
with garbage rather than whitespace after it, but only if it's small
enough (I tested it with the header sizes forged to 127 bytes instead of
255 [2] and McAfee picked it up just fine). Presumably, mindful of the
defined limitations of the EICAR test file, McAfee won't pick up EICAR
in files >128 bytes in order to avoid complications from EICAR appearing
in documents not intended for scanner testing (like [1]).

If you really want to find out if scanners are vulnerable to this,
you'll probably need to use a real virus in the zip.


[1] http://www.eicar.org/anti_virus_test_file.htm

[2] You can find the file I used here:
http://runawaynet.com/~nknight/avt/Antigen-forgedcrc-fixedsize.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Red Hat - http://enigmail.mozdev.org

iD8DBQFCtwzzUsZlh+GmLlQRAgADAKDFBu6gC+LEXVaholDSPq BZ1Vvq8QCdG97m
S+fxK1JfFLRDNa/vQsctTlg=
=Jr2u
-----END PGP SIGNATURE-----