H+BEDV AntiVir MS-DOS Name Scan Evasion Vulnerability
BID:11444
Info
H+BEDV AntiVir MS-DOS Name Scan Evasion Vulnerability
| Bugtraq ID: | 11444 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 18 2004 12:00AM |
| Updated: | Oct 18 2004 12:00AM |
| Credit: | Discovery is credited to Sowhat <[email protected]>. |
| Vulnerable: |
H+BEDV AntiVir Windows Workstation 6.28 .00.01 H+BEDV AntiVir Windows Server NT/2000/2003 6.28 .01.03 H+BEDV AntiVir DOS 6.28 .00.03 |
| Not Vulnerable: |
H+BEDV AntiVir Windows Workstation 6.28 .00.07 H+BEDV AntiVir Windows Server NT/2000/2003 6.28 .01.10 H+BEDV AntiVir DOS 6.28 .00.07 |
Discussion
H+BEDV AntiVir MS-DOS Name Scan Evasion Vulnerability
AntiVir is affected by a scan evasion vulnerability when handling files with MS-DOS reserved device names. This issue is due to a design error that allows the files to avoid being scanned.
Apparently it is possible for an attacker to name a standard file after a reserved MS-DOS device name. The attacker may deliver the file to a user through various delivery mechanisms. If successful, the attacker may leverage this issue to bypass the scanner protection provided by the vulnerable antivirus scanner, giving users a false sense of security.
A similar vulnerability affecting Symantec Norton AntiVirus was reported in BID 11328 (Symantec Norton AntiVirus MS-DOS Name Scan Evasion Vulnerability). The researcher responsible for discovering this issue has stated that this vulnerability is identical to the issue described in BID 11328. Therefore, it is conjectured that this issue does not present a risk factor when a file is sent through email and only arises once the file is already present on a vulnerable computer.
This BID will be updated as more information becomes available.
AntiVir is affected by a scan evasion vulnerability when handling files with MS-DOS reserved device names. This issue is due to a design error that allows the files to avoid being scanned.
Apparently it is possible for an attacker to name a standard file after a reserved MS-DOS device name. The attacker may deliver the file to a user through various delivery mechanisms. If successful, the attacker may leverage this issue to bypass the scanner protection provided by the vulnerable antivirus scanner, giving users a false sense of security.
A similar vulnerability affecting Symantec Norton AntiVirus was reported in BID 11328 (Symantec Norton AntiVirus MS-DOS Name Scan Evasion Vulnerability). The researcher responsible for discovering this issue has stated that this vulnerability is identical to the issue described in BID 11328. Therefore, it is conjectured that this issue does not present a risk factor when a file is sent through email and only arises once the file is already present on a vulnerable computer.
This BID will be updated as more information becomes available.
Exploit / POC
H+BEDV AntiVir MS-DOS Name Scan Evasion Vulnerability
An exploit is not required to leverage this issue.
An exploit is not required to leverage this issue.
Solution / Fix
H+BEDV AntiVir MS-DOS Name Scan Evasion Vulnerability
Solution:
The vendor has released new versions of the affected packages to resolve this issue:
H+BEDV AntiVir Windows Server NT/2000/2003 6.28 .01.03
H+BEDV AntiVir Windows Workstation 6.28 .00.01
H+BEDV AntiVir DOS 6.28 .00.03
Solution:
The vendor has released new versions of the affected packages to resolve this issue:
H+BEDV AntiVir Windows Server NT/2000/2003 6.28 .01.03
-
H+BEDV antivir_server_2k3_de.zip
http://dl.antivir.de/down/windows/antivir_server_2k3_de.zip
H+BEDV AntiVir Windows Workstation 6.28 .00.01
-
H+BEDV antivir_workstation_win_de.zip
http://dl.antivir.de/down/windows/antivir_workstation_win_de.zip
H+BEDV AntiVir DOS 6.28 .00.03
-
H+BEDV antivir_dos_de.zip
http://dl.antivir.de/down/dos/antivir_dos_de.zip
References
H+BEDV AntiVir MS-DOS Name Scan Evasion Vulnerability
References:
References:
- Vendor Homepage (H+BEDV)
- Mutiple AntiVirus Reserved Device Name Handling Vulnerability ("Sowhat ."