Aladdin eSafe Unspecified Archive File Scan Evasion Vulnerability

Bugtraq ID:	34726
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 27 2009 12:00AM
Updated:	May 08 2009 12:58AM
Credit:	Thierry Zoller
Vulnerable:	Aladdin Knowledge Systems eToken 3.3.3 Aladdin Knowledge Systems eSafe Gateway 3.5 Aladdin Knowledge Systems eSafe Gateway 3.0 Aladdin Knowledge Systems eSafe Gateway 2.2 Aladdin Knowledge Systems eSafe Gateway 2.1 Aladdin eSafe 7.0 Aladdin eSafe 6
Not Vulnerable:

Aladdin eSafe Unspecified Archive File Scan Evasion Vulnerability

Aladdin eSafe is prone to a vulnerability that may allow RAR archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

Aladdin eSafe Unspecified Archive File Scan Evasion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Aladdin eSafe Unspecified Archive File Scan Evasion Vulnerability

Solution:
The vendor released a fix to address this issue. Please contact the vendor for more information.

Aladdin eSafe Unspecified Archive File Scan Evasion Vulnerability

References:

• Aladdin eSafe generic evasion / bypass (Thierry Zoller)
  
• eSafe product Homepage (Aladdin Knowledge Systems)
  
• Thierry Zoller ([TZO-15-2009] Aladdin eSafe generic bypass - Forced release)
  
• Update: [TZO-15-2009] Aladdin eSafe generic bypass - Forced release (Thierry Zoller )
  
• Archive Bypass Issue and eSafe (Aladdin Knowledge Systems)