Multiple Antivirus Vendors Overly Long Path Length Local Scanner Bypass Vulnerability

Bugtraq ID:	44374
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	No
Local:	Yes
Published:	Oct 22 2010 12:00AM
Updated:	Oct 22 2010 12:00AM
Credit:	Marcin �??Icewall�?� Noga
Vulnerable:	VirusBuster Command-line Antivirus 1.5.6 ViRobot ViRobot 2008, 8, 6, 131 Trend Micro Antivirus 17.50.0.1366 Symantec Norton AntiVirus 17.6.0.32 Sophos Anti-Virus 9.5.1 Sophos Anti-Virus 9 Quick Heal Technologies Antivirus 11.00 PC Tools PC Tools AntiVirus 7, 0, 3, 5 Panda Antivirus 9.01.00 Norman NVC C Command Line Scanner 5.99.02 Microsoft MP Command Line Scanner 1.1.4405.0 Kaspersky Anti-Virus 11.0.0.232 INCA Tachyon Anti-Virus v2.0,build 1203 Ikarus T3SCAN 1.32.12.0 Hacksoft TheHacker 6.5.2.1.356 G DATA AntiVirus Command Line 3.0.8260.919 Frisk Software F-Prot Antivirus 4.6.1.107 Fortinet Antivirus 4.1.143 F-Secure Anti-Virus 1.30.15265.0 Dr.Web Scanner for Windows 5.00.0.0905070 Comodo Antivirus Console Scanner 4.0 AVL SDK 2.0 Powered by Antiy Labs 2.0.3.7 AVIRA AntiVir Engine 10.0.0.567 AVG AVG 9.0.0.851 Avast Avast Antivirus Free 5.0.594 Authentium Commandline Scanner 5.2.0 Ahnlab Smart Defense Scanner for Windows Console 2.0.0.11
Not Vulnerable:

Multiple Antivirus Vendors Overly Long Path Length Local Scanner Bypass Vulnerability

Multiple vendors' antivirus products are prone to a security-bypass vulnerability.

A successful attack can allow local attackers to bypass antivirus file scans. In some cases, the affected antivirus scanner will crash or fail to perform further scans on suspicious files, aiding in further attacks. Additionally, buffer overflow errors may be triggered, leading to the potential execution of arbitrary code.

The following antivirus products are affected:

Sophos 9.5.1
TrendMicro 17.50.0.1366
AVIRA 10.0.0.567
Norton 17.6.0.32
AVAST 5.0.594.0
AVG 9.0.0.851
F-Secure 1.30.15265.0
Kaspersky 11.0.0.232
Panda 9.01.00
AhnLab - Smart Defense Scanner for Windows Console 2.0.0.11
AVL SDK 2.0 Powered by Antiy Labs 2.0.3.7
Authentium Commandline Scanner 5.2.0
Comodo Antivirus Console Scanner 4.0
Dr.Web Scanner for Windows 5.00.0.0905070
Fortinet Scanner 4.1.143
FRISK Software International 4.6.1.107
G DATA AntiVirus Command Line 3.0.8260.919
Microsoft MP Command Line Scanner 1.1.4405.0
(Norman) NVC C Command Line Scanner 5.99.02
Tachyon Anti- Virus v2.0,build 1203
PC Tools 7, 0, 3, 5
Quick Heal 11.00
IKARUS - T3SCAN 1.32.12.0
The Hacker Antivirus 6.5.2.1.356
Virusbuster Command-line 1.5.6
ViRobot 2008, 8, 6, 131

Multiple Antivirus Vendors Overly Long Path Length Local Scanner Bypass Vulnerability

Local attackers can use readily available tools to exploit this issue.

Multiple Antivirus Vendors Overly Long Path Length Local Scanner Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Multiple Antivirus Vendors Overly Long Path Length Local Scanner Bypass Vulnerability

References:

• Windows LongPaths: extended-length path (Hipasec Sistemas)