Re: [Full-Disclosure] [ GLSA 200501-46 ] ClamAV: Multiple issues

[Trog]

--=-eP5SfedGvb3uA1IJhDtf
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Mon, 2005-01-31 at 20:41 +0100, Sune Kloppenborg Jeppesen wrote:

>=20
> By sending a base64 encoded image file in a URL an attacker could evade
> virus scanning.

It's somewhat harsh to single out ClamAV for this issue. AFAICT, the
only two virus scanners that do currently protect against this are
ClamAV and AntiVir.

According to current testing, all the others, including:

AVG
Avast
BitDefender
DrWeb
eTrust-Iris
eTrust-Vet
F-Prot
F-Secure
Kaspersky
mks_vir
NOD32
Norman Virus Control
Panda8
Sophos
Sybari
Symantec

do not offer protection against this issue. If anyone sees any errors in
the list above, please let me know

-trog


--=-eP5SfedGvb3uA1IJhDtf
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBB/0c+9PDUb2r4PKMRAkjSAKCNHkIHRlwEN+gwF5rONah4enWiMAC fS41C
94C8QXKQIFs5GJuXXdxJ63I=
=k5NU
-----END PGP SIGNATURE-----

--=-eP5SfedGvb3uA1IJhDtf--

[Dack]

> > By sending a base64 encoded image file in a URL an attacker could evade
> > virus scanning.
> It's somewhat harsh to single out ClamAV for this issue. AFAICT, the
> only two virus scanners that do currently protect against this are

What mail clients, if any, would execute a virus encoded in this manner?
Is this a gaping hole in other mail anti-virus systems, or do most
clients just ignore this kind of data?

[Darren Bounds]

Dack,

That depends on the payload. While browsers like Thunderbird, Mail.app
and Opera mail and Konquer will render RFC 2397 formatted images, only
Opera mail supports and executes RFC 2397 formatted application data.
IE does not support for RFC 2397, hense neither does Outlook.

Please be advised that this issue does not only affect AV systems, but
also IDS and IPS technologies. Since my original advisory Jan 10th,
(http://www.intrusense.com/av-bypass/...s-advisory.txt), CheckPoint,
TippingPoint and ClamAV have added support to either detect malicious
RFC 2397 formatted content, or flat out block it. There's certainly
room for improvement, but it's a start.

Here is the response from Trend, dated Jan 24th, 2005:

Dear Darren,

Here is the Official Statement from our Scan Engine Team.
1. Explanation of the vulnerability

This vulnerability arise because our products (and this includes the
engine) does not support RFC 2397 (The "data" URL scheme). This RFC
permits the embedding of files (be it a JPEG, EXE, or other files) in
an HTML file. A file can be embedded in an HTML file by encoding it
using base64.

This was tested using a JPEG file and an EICAR file. The JPEG file is
detected as EXPL_MS04-028.A, but when embedded in an HTML, the JPEG
file is not detected. The embedded EICAR file is also not detected.

Link to the original FD post.
<http://lists.netsys.com/pipermail/fu.../2005-January/
030724.html>


2. How it affects the Trend Products

Trend Micro Products cannot not detect images, or any malicious files,
encoded in base64 that are embedded in HTML files (in accordance with
RFC 2397).

3. How do we solve it.

- Ask users to apply the patch.
- We can create file-specific signatures for any threat that uses this
vulnerability
- Scan Engine update to support RFC 2397

4. Schedules of releases, milestones, etc

- File-specific detection is already available anytime but it is sample
dependent. We need to have a sample before we can create a solution.
- Scan Engine development to fix this will start very soon. We are
estimating around 4-6 weeks development. Ill get back to you on the
exact schedule.



Thank you,

Darren Bounds
Intrusense LLC.
http://www.intrusense.com

--
Intrusense - Securing Business As Usual




On Feb 1, 2005, at 5:41 PM, Dack wrote:

>>> By sending a base64 encoded image file in a URL an attacker could
>>> evade
>>> virus scanning.
>> It's somewhat harsh to single out ClamAV for this issue. AFAICT, the
>> only two virus scanners that do currently protect against this are
>
> What mail clients, if any, would execute a virus encoded in this
> manner?
> Is this a gaping hole in other mail anti-virus systems, or do most
> clients just ignore this kind of data?

[exon]

Trog wrote:
> On Tue, 2005-02-01 at 14:41 -0800, Dack wrote:
>
>>>>By sending a base64 encoded image file in a URL an attacker could evade
>>>>virus scanning.
>>>
>>>It's somewhat harsh to single out ClamAV for this issue. AFAICT, the
>>>only two virus scanners that do currently protect against this are
>>
>>What mail clients, if any, would execute a virus encoded in this manner?
>>Is this a gaping hole in other mail anti-virus systems, or do most
>>clients just ignore this kind of data?
>
>
> I really haven't tested mail clients, but Thunderbird would be the most
> likely.
>

Nopes. Thunderbird, being a client designed to run under a plethora of
platforms, doesn't bother with executing code at all unless explicitly
asked to. In my opinion that's one of its greatest feature.