IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
BID:34345
Info
IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
| Bugtraq ID: | 34345 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1240 CVE-2009-2543 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 02 2009 12:00AM |
| Updated: | Jul 29 2009 10:15PM |
| Credit: | Thierry Zoller |
| Vulnerable: |
IBM Proventia 4.9.0.0.44 20081231 |
| Not Vulnerable: | |
Discussion
IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
IBM Proventia is prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.
Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.
IBM Proventia 4.9.0.0.44 20081231 is vulnerable; other versions may also be affected.
UPDATE (April 14, 2009): The vendor reports that as of January 2008, the 'Virus Prevention System' (the vulnerable component) is no longer incorporated in IBM Proventia products.
IBM Proventia is prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.
Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.
IBM Proventia 4.9.0.0.44 20081231 is vulnerable; other versions may also be affected.
UPDATE (April 14, 2009): The vendor reports that as of January 2008, the 'Virus Prevention System' (the vulnerable component) is no longer incorporated in IBM Proventia products.
Exploit / POC
IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
Solution:
The vendor reports that as of January 2008, the 'Virus Prevention System' (the vulnerable component) is no longer incorporated in IBM Proventia products.
Solution:
The vendor reports that as of January 2008, the 'Virus Prevention System' (the vulnerable component) is no longer incorporated in IBM Proventia products.
References
IBM Proventia RAR/ZIP/CAB File Scan Evasion Vulnerability
References:
References:
- IBM Proventia - Evasion (limited details) (Thierry Zoller)
- IBM Proventia Homepage (IBM)
- Re: Update: [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - s (Vladimir '3APA3A' Dubrovin)
- Re[2]: Update: [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure (Thierry Zoller)
- Update: [TZO-06-2009] IBM Proventia - Generic bypass (Limited disclosure - see d (Thierry Zoller)
- Does the 'TZO-04-2009-IBM Proventia' evasion apply to any IBM ISS products? (IBM)