Proland Software Protector Plus AntiVirus MS-DOS Name Scan Evasion Vulnerability
BID:11451
Info
Proland Software Protector Plus AntiVirus MS-DOS Name Scan Evasion Vulnerability
| Bugtraq ID: | 11451 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 18 2004 12:00AM |
| Updated: | Oct 18 2004 12:00AM |
| Credit: | Discovery is credited to Sowhat <[email protected]>. |
| Vulnerable: |
Proland Software Protector Plus 2000 7.2 F07 |
| Not Vulnerable: | |
Discussion
Proland Software Protector Plus AntiVirus MS-DOS Name Scan Evasion Vulnerability
Protector Plus is affected by a scan evasion vulnerability when handling files with MS-DOS reserve device names. This issue is due to a design error that allows the files to avoid being scanned.
Apparently it is possible for an attacker to name a standard file after a reserved MS-DOS device name. The attacker may deliver the file to a user through various delivery mechanisms. If successful, the attacker may leverage this issue to bypass the scanner protection provided by the vulnerable antivirus scanner, giving users a false sense of security.
A similar vulnerability affecting Symantec Norton AntiVirus was reported in BID 11328 (Symantec Norton AntiVirus MS-DOS Name Scan Evasion Vulnerability). The researcher responsible for discovering this issue has stated that this vulnerability is identical to the issue described in BID 11328. Therefore, it is conjectured that this issue does not present a risk factor when a file is sent through email and only arises once the file is already present on a vulnerable computer.
This BID will be updated as more information becomes available.
Protector Plus is affected by a scan evasion vulnerability when handling files with MS-DOS reserve device names. This issue is due to a design error that allows the files to avoid being scanned.
Apparently it is possible for an attacker to name a standard file after a reserved MS-DOS device name. The attacker may deliver the file to a user through various delivery mechanisms. If successful, the attacker may leverage this issue to bypass the scanner protection provided by the vulnerable antivirus scanner, giving users a false sense of security.
A similar vulnerability affecting Symantec Norton AntiVirus was reported in BID 11328 (Symantec Norton AntiVirus MS-DOS Name Scan Evasion Vulnerability). The researcher responsible for discovering this issue has stated that this vulnerability is identical to the issue described in BID 11328. Therefore, it is conjectured that this issue does not present a risk factor when a file is sent through email and only arises once the file is already present on a vulnerable computer.
This BID will be updated as more information becomes available.
Exploit / POC
Proland Software Protector Plus AntiVirus MS-DOS Name Scan Evasion Vulnerability
An exploit is not required to leverage this issue.
An exploit is not required to leverage this issue.
Solution / Fix
Proland Software Protector Plus AntiVirus MS-DOS Name Scan Evasion Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Proland Software Protector Plus AntiVirus MS-DOS Name Scan Evasion Vulnerability
References:
References:
- Vendor Homepage (Proland Software)
- Mutiple AntiVirus Reserved Device Name Handling Vulnerability ("Sowhat ."