Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through

mgotts_at_2roads.com
Date: 10/28/05

  • Next message: Andrey Bayora: "Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through"
    To: Andrey Bayora <andrey@securityelf.org>
    Date: Fri, 28 Oct 2005 09:52:38 -0700
    
    

    > > Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability
    through
    > > forged magic byte.
    >
    > > AUTHOR: Andrey Bayora (www.securityelf.org)
    >
    > > For more details, screenshots and examples please read my article "The
    Magic
    > > of magic byte" at www.securityelf.org . In addition, you will find a
    sample
    > > "triple headed" program which has 3 different 'execution entry
    points',
    > > depending on the extension of the file (exe, html or eml) - just
    change the
    > > extension and the SAME file will be executed by (at least) THREE
    DIFFERENT
    > > programs! (thanks to contributing author Wayne Langlois from
    > > www.diamondcs.com.au).
    >

    Below I copied Trend Micro's response to the "magic byte" vulnerability in
    their products:

    ========================================
    Dear Valued Client,

    Greetings!

    My name is <removed>. I will be the one handling your case.

    Please correct me if I left some issues or if I misunderstood your
    concern.

    Trend Micro is aware of a potential vulnerability related to the "forged
    magic byte" in certain file types. Based on our analysis, this
    vulnerability is limited in our products to one specific type of potential
    virus file which is not commonly allowed in most IT systems and needs to
    be executed manually. Trend Micro customers are currently able to detect
    such files -- should they be created -- through our virus pattern file,
    2.915.00.

    Please make sure that you regularly update your virus definitions. Hope
    this information helps.

    ========================================

    Any comments on their response?

    -- Mark


  • Next message: Andrey Bayora: "Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through"

    Relevant Pages