Multiple IKARUS Products RAR/CAB/ZIP File Scan Evasion Vulnerability

Bugtraq ID:	35358
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 13 2009 12:00AM
Updated:	Jun 19 2009 06:09PM
Credit:	Thierry Zoller
Vulnerable:	Ikarus virus utilities 0 Ikarus security proxy 0 Ikarus security manager 0 Ikarus myM_at_ilWall 0
Not Vulnerable:

Multiple IKARUS Products RAR/CAB/ZIP File Scan Evasion Vulnerability

Multiple IKARUS products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

The following products are affected:

IKARUS virus utilities (scan-time)
IKARUS myM_at_ilWall
IKARUS content wall
IKARUS security proxy

Multiple IKARUS Products RAR/CAB/ZIP File Scan Evasion Vulnerability

NOTE: The researcher who reported this issue has developed proofs of concept, but they are not publicly available.

Multiple IKARUS Products RAR/CAB/ZIP File Scan Evasion Vulnerability

Solution:
Reports indicate that the vendor has released fixes to address this issue, but Symantec has not confirmed this information. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple IKARUS Products RAR/CAB/ZIP File Scan Evasion Vulnerability

References:

• Home Page (IKARUS)
  
• Ikarus multiple generic evasions (Thierry Zoller)
  
• [TZO-31-2009] Ikarus multiple generic evasions (CAB,ZIP,RAR) (Thierry Zoller )