Bugtraq mailing list archives
Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning
From: "Dr. Peter Bieringer" <pbieringer () aerasec de>
Date: Mon, 14 Mar 2005 15:21:18 +0100
Hello,during investigation of Sober.l we got the idea to replace the spaces of a filename contained in the ZIP archive by some escape sequences.
Many AV software is logging such filenames during decompressing, so after creating such regular ZIP archive (by using Perl Archive::Zip module, no other tweaks!) we've found that some of the tested products do not filter or replace the escape sequences, which leads to funny results during displaying the output of the AV scanner or viewing the log.
Also we found that at least 2 AV scan programs from 2 vendors do not detect the virus inside and report "clean" instead.
See here for more details: <ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/unfiltered-escape-sequences.txt> <http://www.aerasec.de/security/index.html?id=ae-200503-020&lang=en> We provide also samples and the Perl program for creating the samples: <ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/>Due lack of time we only tested a few products, so if one can provide results of other products, pls. send them (also) to us. Thank you!
Regards, Dr. Peter Bieringer -- Dr. Peter Bieringer Phone: +49-8102-895190 AERAsec Network Services and Security GmbH Fax: +49-8102-895199 Wagenberger Strasse 1 Mobile: +49-174-9015046 D-85662 Hohenbrunn E-Mail: pbieringer () aerasec de Germany Internet: http://www.aerasec.de
Attachment:
_bin
Description:
Current thread:
- Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning Dr. Peter Bieringer (Mar 14)
- Message not available
- <Possible follow-ups>
- Re: Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning Thierry Zoller (Mar 15)