Multiple ESET Antivirus Products RAR File Scan Evasion Vulnerability

Bugtraq ID:	34582
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 17 2009 12:00AM
Updated:	Apr 21 2009 12:26AM
Credit:	Thierry Zoller
Vulnerable:	Eset Smart Security 4 Business Edition 0 Eset Smart Security 4 0 Eset Novell Netware 0 Eset NOD32 Antivirus for Lotus Domino Server 0 Eset NOD32 Antivirus for Linux Gateway Devices 0 Eset NOD32 Antivirus for Exchange Server 0 Eset NOD32 Antivirus 4 Business Edition 0 Eset NOD32 Antivirus 4 0 Eset NOD32 Antivirus 0 Eset NOD32 Eset Mail Security 0 Eset File Security 0 Eset DELL STORAGE SERVERS 0
Not Vulnerable:

Multiple ESET Antivirus Products RAR File Scan Evasion Vulnerability

Multiple ESET products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

The following are vulnerable:

ESET Smart Security 4
ESET NOD32 Antivirus 4
ESET Smart Security 4 Business Edition
ESET NOD32 Antivirus 4 Business Edition
ESET NOD32 Antivirus for Exchange Server
ESET Mail Security
ESET NOD32 Antivirus for Lotus Domino Server
ESET File Security
ESET Novell Netware
ESET DELL STORAGE SERVERS
ESET NOD32 Antivirus for Linux gateway devices

Multiple ESET Antivirus Products RAR File Scan Evasion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple ESET Antivirus Products RAR File Scan Evasion Vulnerability

Solution:
The vendor has released updates. Please contact the vendor for details.

Multiple ESET Antivirus Products RAR File Scan Evasion Vulnerability

References:

• ESET Software Homepage (ESET Software)
  
• ThreatSense Virus Signature Database Updates - page 3 (ESET)
  
• [TZO-09-2009] NOD32 (Eset) bypass / evasion (Limited details) (Thierry Zoller )