McAfee Products RAR/ZIP Files Scan Evasion Vulnerability
BID:34780
Info
McAfee Products RAR/ZIP Files Scan Evasion Vulnerability
| Bugtraq ID: | 34780 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1348 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 30 2009 12:00AM |
| Updated: | May 01 2009 10:46PM |
| Credit: | Thierry Zoller and Mickael Roger |
| Vulnerable: |
McAfee VirusScan USB 0 McAfee VirusScan Professional McAfee VirusScan Plus 2009 McAfee VirusScan Enterprise Linux 0 McAfee VirusScan Enterprise for Storage 0 McAfee VirusScan Enterprise for SAP 0 McAfee VirusScan Enterprise 0 McAfee VirusScan Command Line McAfee Total Protection for Endpoint 0 McAfee Total Protection 2009 McAfee Total Protection 0 McAfee SecurityShield for Microsoft ISA Server McAfee Security for Microsoft Sharepoint 0 McAfee Security for Email Servers 0 McAfee Internet Security 0 McAfee Email Gateway 0 McAfee Active VirusScan McAfee Active Virus Defense |
| Not Vulnerable: | |
Discussion
McAfee Products RAR/ZIP Files Scan Evasion Vulnerability
Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.
Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.
The issue affects all McAfee software that uses DAT files.
Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.
Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.
The issue affects all McAfee software that uses DAT files.
Exploit / POC
McAfee Products RAR/ZIP Files Scan Evasion Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: The researcher who reported this issue has developed proofs of concept, but they are not publicly available.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
NOTE: The researcher who reported this issue has developed proofs of concept, but they are not publicly available.
Solution / Fix
McAfee Products RAR/ZIP Files Scan Evasion Vulnerability
Solution:
Updates are available through DAT files 5600 or later. Please see the references for more information.
Solution:
Updates are available through DAT files 5600 or later. Please see the references for more information.
References
McAfee Products RAR/ZIP Files Scan Evasion Vulnerability
References:
References:
- McAfee Homepage (McAfee)
- [TZO-18-2009] Mcafee multiple evasions/bypasses (RAR, ZIP) (Thierry Zoller
- Mcafee multiple bypasses/evasions (ZIP,RAR) (Thierry Zoller)
- McAfee Security Bulletin - VirusScan Engine update fixes bypasses (McAfee)