F-Secure Products PDF Files Scan Evasion Vulnerability

Bugtraq ID:	36876
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 27 2009 12:00AM
Updated:	Oct 29 2009 07:17PM
Credit:	Thierry Zoller
Vulnerable:	F-Secure Protection Service for Consumers 8.00 F-Secure Protection Service for Consumers 7.00 F-Secure Protection Service for Business - Workstation 8.00 F-Secure Protection Service for Business - E-mail and Server 8.00 F-Secure Linux Security 7.02 F-Secure Linux Security 7.01 F-Secure Internet Security 2007 Second Edition 0 F-secure Internet Security 2006 0 F-Secure Internet Security 2005 F-Secure Internet Security 2004 F-Secure Internet Security 2003 F-Secure Internet Security 2009 F-Secure Internet Security 2008 F-Secure Internet Security 2007 F-Secure Internet Gatekeeper for Windows 6.61 F-Secure Internet Gatekeeper for Linux Japanese 2.37 F-Secure Internet Gatekeeper for Linux 2.15.484 F-Secure Internet Gatekeeper for Linux 2.14 F-Secure Internet Gatekeeper for Linux 2.6 F-Secure Internet Gatekeeper for Linux 2.0 6 F-Secure Internet Gatekeeper for Linux 3.02 F-Secure Internet Gatekeeper for Linux 3.01 F-Secure Internet Gatekeeper for Linux 2.16 F-Secure Home Server Security 2009 F-Secure Client Security 8.01 F-Secure Client Security 8.0 F-Secure Client Security 7.12 F-Secure Client Security 7.11 F-Secure Anti-Virus Linux Server Security 5.11 F-Secure Anti-Virus Linux Server Security 5.0 4 F-Secure Anti-Virus Linux Server Security 5.0 1 F-Secure Anti-Virus Linux Server Security 5.0 F-Secure Anti-Virus Linux Server Security 5.54 F-Secure Anti-Virus Linux Server Security 5.52 F-Secure Anti-Virus Linux Server Security 5.30 F-secure Anti-Virus Linux Client Security 5.11 F-secure Anti-Virus Linux Client Security 5.0.4 F-secure Anti-Virus Linux Client Security 5.0 1 F-secure Anti-Virus Linux Client Security 5.0 F-secure Anti-Virus Linux Client Security 5.54 F-secure Anti-Virus Linux Client Security 5.52 F-secure Anti-Virus Linux Client Security 5.30 F-Secure Anti-Virus for Workstations 5.44 F-Secure Anti-Virus for Workstations 5.43 F-Secure Anti-Virus for Workstations 5.42 F-Secure Anti-Virus for Workstations 5.41 F-Secure Anti-Virus for Workstations 5.40 F-Secure Anti-Virus for Workstations 8.0 F-Secure Anti-Virus for Workstations 7.11 F-Secure Anti-Virus for Workstations 7.00 F-Secure Anti-Virus for Windows Servers 5.52 F-Secure Anti-Virus for Windows Servers 5.50 F-Secure Anti-Virus for Windows Servers 5.42 F-Secure Anti-Virus for Windows Servers 5.41 F-Secure Anti-Virus for Windows Servers 8.00 F-Secure Anti-Virus for Windows Servers 7.00 F-Secure Anti-Virus for MIMEsweeper 5.61 F-Secure Anti-Virus for MIMEsweeper 5.51 F-Secure Anti-Virus for MIMEsweeper 5.50 F-Secure Anti-Virus for MIMEsweeper 5.42 F-Secure Anti-Virus for MIMEsweeper 5.41 F-Secure Anti-Virus for Microsoft Exchange 8.00 F-Secure Anti-Virus for Linux Servers 4.64 F-Secure Anti-Virus for Linux Servers 4.61 F-Secure Anti-Virus for Linux Servers 4.52 F-Secure Anti-Virus for Linux Servers 4.51 F-Secure Anti-Virus for Linux Servers 4.65 F-Secure Anti-Virus for Citrix Servers 5.52 F-Secure Anti-Virus for Citrix Servers 5.5 F-Secure Anti-Virus for Citrix Servers 7.00 F-Secure Anti-Virus 2007 0 F-Secure Anti-Virus 2006 0 F-secure Anti-Virus 2005 F-Secure Anti-Virus 2004 F-Secure Anti-Virus 2003 F-Secure Anti-Virus 2009 F-Secure Anti-Virus 2008 F-Secure Anti-Virus 2007 Second Edition
Not Vulnerable:

F-Secure Products PDF Files Scan Evasion Vulnerability

Multiple F-Secure products are prone to a vulnerability that may allow certain files to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application on a gateway device will fail to detect.

F-Secure Products PDF Files Scan Evasion Vulnerability

The researcher who reported this issue has developed a proof of concept, but it is not publicly available.

F-Secure Products PDF Files Scan Evasion Vulnerability

Solution:
Updates are available through the automatic update channel. Please see the references for details.

F-Secure Products PDF Files Scan Evasion Vulnerability

References:

• F-Secure - Generic PDF detection bypass (G-SEC)
  
• Security Advisory FSC-2009-3 (F-Secure)