> Subject: Re: Multiple Vendor Anti-Virus Software Detection=20
> Evasion Vulnerability through forged magic byte
> From: "Andrey Bayora" <andrey () securityelf ! org>
> Date: 2005-10-25 3:07:51
>
> [...]
>
> VULNERABLE vendors and software (tested):
>
> [...]
>
> 3. eTrust CA (ver 7.0.1.4, engine 11.9.1, vir sig. 9229)
>
> [...]
> DESCRIPTION:
>
> The problem exists in the scanning engine - in the routine that
> determines the file type. If some file types (file types tested
> are .BAT, .HTML and .EML) changed to have the MAGIC BYTE of the=20
> EXE files (MZ) at the beginning, then many antivirus programs=20
> will be unable to detect the malicious file. It will break the=20
> normal flow of the antivirus scanning and many existent and=20
> future viruses will be undetected.

Andrey,

Thank you for the report. =20

You are effectively altering existing viruses to the point that=20
AV scanners do not detect them. If your altered virus sample=20
still executes correctly, you have simply created a new virus=20
variant. If your altered virus sample does not execute properly,=20
you have created nothing more than a corrupt virus sample.

Consequently, the issue that you describe is *not* a=20
vulnerability issue, but rather just an example of a new variant
that has not yet been added to an AV vendor's database of "known
viruses".

Note that CA eTrust Antivirus, when running in Reviewer mode,=20
should already detect these new variants.

Regards,
Ken=20
=20
Ken Williams ; Dir. Vuln Research=20
Computer Associates ; 0xE2941985