RE: FAX a virus



Alcides,

Others on this list, and especially on the Pen Test list, can speak much
more suitably than I can on this issue, but I will contribute the
following.

This depends entirely on how the input to the "document processing
system" is sanitized. If the document processing system blindly accepts
user input as valid, then you potentially have an issue.

If the document processing system runs as a service on your Windows
boxes, check to ensure that it launches with an account that does not
have System or Admin rights on the box.

Kind Regards,
Scott Ramsdell

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Alcides
Sent: Wednesday, February 28, 2007 10:37 PM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: FAX a virus

Hi lists,
My FAX server allows me to receive faxes from my clients from Internet.
My clients send me some documents using their built-in Fax Printer on
their PC. My fax server routes the stuff to the document processing
applications. The document processing system extracts various data
fields from received portable document format files.
The whole scenario is windows environment and let's assume that virus
protection is temporarily off.

Now, I have a query:
Can anyone send a fax that includes a file infected with the virus/ worm

operates as a VBS script embedded within a PDF/TIF file to cause
infections to my computers/ to affect my FAX system?
What about other possibilities of "the bad guys" using some joiner (or
wrapper as some say) to bind malware (trojan server etc) with the pdf/
TIF files and fax it to me?
I would be very greatful to know what are the various possibilities.

Warm regards,
Alcides.

------------------------------------------------------------------------
---
This list is sponsored by: BigFix

If your IT fails, you're out of business - or worse. Arm your
enterprise with BigFix, the single converged IT security and operations
engine. BigFix enables continuous discovery, assessment, remediation,
and enforcement for complex and distributed IT environments in real-time

from a single console.
Think what's next. Think BigFix.

http://ad.doubleclick.net/clk;82309979;15562032;o?http://www.bigfix.com/
ITNext/
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
This list is sponsored by: BigFix

If your IT fails, you're out of business - or worse. Arm your
enterprise with BigFix, the single converged IT security and operations
engine. BigFix enables continuous discovery, assessment, remediation,
and enforcement for complex and distributed IT environments in real-time
from a single console.
Think what's next. Think BigFix.

http://ad.doubleclick.net/clk;82309979;15562032;o?http://www.bigfix.com/ITNext/
---------------------------------------------------------------------------



Relevant Pages

  • RE: FAX a virus
    ... Attached is a small piece of code designed to write memory without freeing that memory - a situation that will eventually cause a memory overrun and crash as I am not freeing the buffer. ... In the above-mentioned situation the attack occurs not because I have received code, but rather as I have decided to run code or script on my system. ... If the document processing system runs as a service on your Windows ... BigFix ...
    (Security-Basics)
  • Re: FAX a virus
    ... In this specific scenario, the threat is extraordinarily low. ... If the document processing system runs as a service on your Windows ... BigFix ...
    (Security-Basics)
  • Re: FAX a virus
    ... In this specific scenario, the threat is extraordinarily low. ... If the document processing system runs as a service on your Windows ... BigFix ...
    (Security-Basics)
  • RE: FAX a virus
    ... You have to have a digital line for digital information ... Errors in code make code break. ... My fax server routes the stuff to the document processing ... BigFix ...
    (Security-Basics)
  • Re: RE: FAX a virus
    ... My FAX server allows me to receive faxes from my clients from Internet. ... My fax server routes the stuff to the document processing ... The document processing system extracts various data ... This may not be a typical virus/worm in the sense that it 'compromises' or 'obtains a shell' on the fax server but it provides a different attack vector in the form of a DOS. ...
    (Security-Basics)