Re: eSafe: Could this be exploited?

From: Andreas Constantinides (MegaHz) (megahz_at_megahz.org)
Date: 07/25/04

  • Next message: Ferruh Mavituna: "ASPRunner Multiple Vulnerabilities" 
    To: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Date: Sun, 25 Jul 2004 17:24:55 +0300

    which version of eSafe are we talking about? 3 or 4 ?

    On Sat, 2004-07-24 at 14:27, 3APA3A wrote:
    > Dear Hugo van der Kooij,
    >
    > --Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq@securityfocus.com:
    >
    > HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the
    > HvdK> end-user before they stop a virus. Then they rely on the adding of the
    > HvdK> exact URL so that URL can be blocked in all next requests.
    >
    > It depends on how antiviral check is actually implemented. If connection
    > is broken immediately after signature is detected - there is no way to
    > download infected file, because signature will not pass to client and
    > client will not be able to use "Range:" header to resume partially
    > downloaded file.
    >
    > If antiviral filter checks data _after_ all data received from client
    > with 20% buffering yes, it's possible to bypass this check for HTTP,
    > because there is no way (at least for HTTP/1.0 and FTP) to indicate
    > error to client and make him to delete partially downloaded data.
    >
    > You can check it, by sending EICAR with some additional data: if you can
    > find EICAR signature on the client after connection is broken by
    > antiviral filter you can bypass it's protection.
    >

  • Next message: Ferruh Mavituna: "ASPRunner Multiple Vulnerabilities"