[NT] Multiple Vendor Antivirus Software Fails to Access Maliciously Named Files

From: SecuriTeam (support_at_securiteam.com)
Date: 11/21/05

  • Next message: SecuriTeam: "[NEWS] Belkin Wireless Devices Authentication Bypass Vulnerability" 
    To: list@securiteam.com
Date: 21 Nov 2005 17:13:06 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple Vendor Antivirus Software Fails to Access Maliciously Named Files
    ------------------------------------------------------------------------

    SUMMARY

    Windows system may use different kinds of special characters inside
    filenames, several anti-virus engines are unable to analyze these
    specially named files, allowing to bypass infected files.

    DETAILS

    Vulnerable anti-virus Engines:
     * Kaspersky Antivirus
     * Symantec AntiVirus
     * F-Prot Antivirus
     * ClamWin Antivirus
     * Avast Antivirus
     * RAV AntiVirus
     * Microsoft AntiSpyware

    Software tested :
     * Symantec AntiVirus Corporate version 8.0
     * Kaspersky Antivirus Personal Pro version 4.5.0.104
     * Kaspersky Antivirus For MS NTServer version 4.5.0.104
     * F-Prot Antivirus version 3.16c
     * ClamWin Antivirus version 0.87
     * Avast.Professional.Edition version 4.6.603
     * RAV.AntiVirus.Desktop version 8.6
     * Microsoft AntiSpyware version beta1

    Choose a malicious file which would be detected, such as nc.exe, rename
    the file as nc??.exe (?? =Hex C0 D7 BA DC) Then these malicious files will
    be not detected by Antivirus scan.

    Because these special names are unable directly to input, so if you want
    to run these file, you should use the following way:

       [ROOT@D:\Vul\bugtrap]#dir /x
       1998-01-03 14:37 59,392 NC294E~1.EXE nc??.exe
       [ROOT@D:\Vul\bugtrap]#NC294E~1.EXE -help
       [v1.10 NT]
       connect to somewhere: nc [-options] hostname port[s] [ports] ...
       listen for inbound: nc -l -p port [options] [hostname] [port]
       options:
       ...

    Uses the MS-DOS name specification, we can operate file with Open Read
    Write and duplicate

    In fact the most vendor all have the problem in regarding this king of
    file parse: For instance use the right key clicks these kinds of file,
    will be no scan option menu to show by Kaspersky Antivirus, and Symantec
    AntiVirus Corporate V10.0.1.1000 will detected but can't remove it. AVG
    Anti-Virus will be passed by normally path scan method, but can't read the
    file if click the scan option menu.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:alert7@xfocus.org> alert7.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Belkin Wireless Devices Authentication Bypass Vulnerability"

    Relevant Pages