Bugtraq mailing list archives
RE: Av issues
From: "David Webster" <dwebster () wittig com>
Date: Mon, 14 Mar 2005 14:11:59 -0500
Symantec Corporate AV client v 9.0.3.1000 with virus defs 3/9/2005 rev. 32 detected ICAR test string in the zip file listed in the poc url. -----Original Message----- From: Bipin Gautam [mailto:visitbipin () hotmail com] Sent: Saturday, March 12, 2005 4:40 AM To: bugtraq () securityfocus com Subject: Av issues In-Reply-To: <20050311203150.17236.qmail () www securityfocus com> In Local file header if you modify "general purpose bit flag" 7th & 8'th byte of a zip archive with \x2f ie: "\" F-port, Kaspersky, Mcafee, Norman, Sybari, Symantec seem to skip the file marking it as clean!!! This was discovered during the analysis of "Multiple AV Vendor Incorrect CRC32 Bypass Vulnerability." Quick/rough conclusion were drawn using www.virustotal.com poc: http://www.geocities.com/visitbipin/gpbf.zip Well, tested with F-prot, DrWeb, *Symantec 8.0 long ago... lately verified it using virustotal.com If you have a long archive coment... in a zip archive these AV can't detect virus embedded in it. I came to know Symantec 8.1 is immune to the bug? POC: http://www.geocities.com/visitbipin/long_coment.zip regards, bipin gautam
Current thread:
- Av issues Bipin Gautam (Mar 12)
- <Possible follow-ups>
- RE: Av issues David Webster (Mar 14)
- Re: Av issues Thierry Zoller (Mar 14)
- Re: Av issues Yves Belle-Isle (Mar 15)
- Re: Av issues Thierry Zoller (Mar 14)
- Re: Av issues bipin gautam (Mar 16)