Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
BID:12269
Info
Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
| Bugtraq ID: | 12269 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2005-0218 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 14 2005 12:00AM |
| Updated: | Jul 12 2009 09:27AM |
| Credit: | Discovery of this weakness is credited to Darren Bounds <lists intrusense com>. |
| Vulnerable: |
Trend Micro WebProtect 3.1 Trend Micro InterScan Messaging Security Suite 5.5 Trend Micro InterScan Messaging Security Suite 3.81 TippingPoint Unity-One with Digital Vacine 2.0.0.2070 McAfee Webshield 3000 4.3.20 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 IronPort IronPort with Sophos AV Engine 3.88 IBM SiteProtector 2.0 SP3 IBM SiteProtector 2.0.4.561 Gentoo Linux Clam Anti-Virus ClamAV 0.81 Clam Anti-Virus ClamAV 0.80 rc4 Clam Anti-Virus ClamAV 0.80 rc3 Clam Anti-Virus ClamAV 0.80 rc2 Clam Anti-Virus ClamAV 0.80 rc1 Clam Anti-Virus ClamAV 0.80 Clam Anti-Virus ClamAV 0.70 Clam Anti-Virus ClamAV 0.68 -1 Clam Anti-Virus ClamAV 0.68 Clam Anti-Virus ClamAV 0.67 Clam Anti-Virus ClamAV 0.65 Clam Anti-Virus ClamAV 0.60 Clam Anti-Virus ClamAV 0.54 Clam Anti-Virus ClamAV 0.53 Clam Anti-Virus ClamAV 0.52 Clam Anti-Virus ClamAV 0.51 Check Point Software FireWall-1 R55 HFA08 with SmartDefense ALT Linux ALT Linux Junior 2.3 ALT Linux ALT Linux Compact 2.3 |
| Not Vulnerable: |
TippingPoint Unity-One with Digital Vacine 2.0.0.2121 |
Discussion
Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs.
A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness.
This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.
Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs.
A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness.
This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.
Exploit / POC
Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
No exploit is required.
No exploit is required.
Solution / Fix
Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
Solution:
It is reported that Trend Micro has released an update to address this vulnerability in affected Trend Micro products. This is not confirmed. Customers are advised to contact the vendor for further details regarding obtaining and applying an appropriate update.
TippingPoint has released Digital Vaccine 2.0.0.2121 to deal with this issue. Users of the affected software are advised to navigate to https://tmc.tippingpoint.com/TMC to acquire the relevant updates.
Gentoo linux has made advisory GLSA 200501-46 dealing with this issue. Gentoo advises that all ClamAV users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.81"
Mandrake has released advisory MDKSA-2005:025 to address this issue in ClamAV on Mandrake platforms. Please see the referenced advisory for more information.
ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.
Solution:
It is reported that Trend Micro has released an update to address this vulnerability in affected Trend Micro products. This is not confirmed. Customers are advised to contact the vendor for further details regarding obtaining and applying an appropriate update.
TippingPoint has released Digital Vaccine 2.0.0.2121 to deal with this issue. Users of the affected software are advised to navigate to https://tmc.tippingpoint.com/TMC to acquire the relevant updates.
Gentoo linux has made advisory GLSA 200501-46 dealing with this issue. Gentoo advises that all ClamAV users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.81"
Mandrake has released advisory MDKSA-2005:025 to address this issue in ClamAV on Mandrake platforms. Please see the referenced advisory for more information.
ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.
References
Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
References:
References:
- [security-announce] I: updated packages available (ALT Linux)
- Multi-vendor AV gateway image inspection bypass vulnerability (Darren Bounds
) - RFC 2397 (RFC2397) (Internet RFC/STD/FYI/BCP Archives)
- Re: [ GLSA 200501-46 ] ClamAV: Multiple issues (Darren Bounds