Sophos Anti-Virus Reserved MS-DOS Name Scan Evasion Vulnerability
BID:11236
Info
Sophos Anti-Virus Reserved MS-DOS Name Scan Evasion Vulnerability
| Bugtraq ID: | 11236 |
| Class: | Design Error |
| CVE: |
CVE-2004-0552 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 22 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Kurt Seifried <[email protected]> is credited with this discovery. |
| Vulnerable: |
Sophos Small Business Suite 1.0 Sophos Anti-Virus 3.85 Sophos Anti-Virus 3.84 Sophos Anti-Virus 3.83 Sophos Anti-Virus 3.82 Sophos Anti-Virus 3.81 Sophos Anti-Virus 3.80 Sophos Anti-Virus 3.79 Sophos Anti-Virus 3.78 d Sophos Anti-Virus 3.78 |
| Not Vulnerable: |
Sophos Anti-Virus 3.86 |
Discussion
Sophos Anti-Virus Reserved MS-DOS Name Scan Evasion Vulnerability
Sophos Anti-Virus is affected by a reserved MS-DOS name virus scan evasion vulnerability. This issue is due to a design error that allows certain files to avoid being scanned.
An attacker may leverage this issue to bypass the scanner protection provided by the vulnerable anti-virus scanner, giving users a false sense of security. It is reported that this issue can be leveraged to bypass both file system and email virus scanners, allowing this issue to be exploited remotely.
Sophos Anti-Virus is affected by a reserved MS-DOS name virus scan evasion vulnerability. This issue is due to a design error that allows certain files to avoid being scanned.
An attacker may leverage this issue to bypass the scanner protection provided by the vulnerable anti-virus scanner, giving users a false sense of security. It is reported that this issue can be leveraged to bypass both file system and email virus scanners, allowing this issue to be exploited remotely.
Exploit / POC
Sophos Anti-Virus Reserved MS-DOS Name Scan Evasion Vulnerability
No exploit is required to leverage this issue. Reportedly it is possible to change the name of a file to an MS-DOS reserved device file name using the following command (in this example, AUX is the target device name):
copy source \\.\C:\aux
No exploit is required to leverage this issue. Reportedly it is possible to change the name of a file to an MS-DOS reserved device file name using the following command (in this example, AUX is the target device name):
copy source \\.\C:\aux
Solution / Fix
Sophos Anti-Virus Reserved MS-DOS Name Scan Evasion Vulnerability
Solution:
The vendor has reported that a new version of the affected software has been released. Please contact the vendor for information on obtaining the upgrade.
Solution:
The vendor has reported that a new version of the affected software has been released. Please contact the vendor for information on obtaining the upgrade.
References
Sophos Anti-Virus Reserved MS-DOS Name Scan Evasion Vulnerability
References:
References:
- Sophos Anti-Virus Home Page (Sophos)
- Sophos Homepage (Sophos)
- iDEFENSE Security Advisory 09.22.04 - Sophos Small Business Suite ("customer service mailbox"