InterScan VirusWall Scan Evasion Vulnerability
BID:899
Info
InterScan VirusWall Scan Evasion Vulnerability
| Bugtraq ID: | 899 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 27 1999 12:00AM |
| Updated: | Dec 27 1999 12:00AM |
| Credit: | First posted to Bugtraq by [email protected] on December 27, 1999. |
| Vulnerable: |
Trend Micro InterScan VirusWall 3.0.1 |
| Not Vulnerable: | |
Discussion
InterScan VirusWall Scan Evasion Vulnerability
Trend Micro's InterScan VirusWall is a product designed to stop the spread of viruses and worms through email. To do so, it filters SMTP traffic for various signatures which match those of viruses. It is possible to evade scanning if malicious code is within a malformed email attachment. If there are more '=' characters than required at the end of a base64 encoded attachment, InterScan will fail to scan the data and let it pass through unchecked. However, InterScan does record when this error occurs; it writes the following to its system logs:
base64: Unexpected EOF seen
The NewApt worm is known to exploit this vulnerability.
Trend Micro's InterScan VirusWall is a product designed to stop the spread of viruses and worms through email. To do so, it filters SMTP traffic for various signatures which match those of viruses. It is possible to evade scanning if malicious code is within a malformed email attachment. If there are more '=' characters than required at the end of a base64 encoded attachment, InterScan will fail to scan the data and let it pass through unchecked. However, InterScan does record when this error occurs; it writes the following to its system logs:
base64: Unexpected EOF seen
The NewApt worm is known to exploit this vulnerability.