Multiple Vendor Virus Scanner Recycle Bin Exclusion Vulnerability
BID:956
Info
Multiple Vendor Virus Scanner Recycle Bin Exclusion Vulnerability
| Bugtraq ID: | 956 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2000-0119 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 22 1999 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | Originally posted to NTBugtraq by Neil Bortnak. |
| Vulnerable: |
Symantec Norton AntiVirus 2000 Network Associates VirusScan for Windows NT 4.0.3 a Network Associates VirusScan for Windows NT 4.0.2 McAfee VirusScan 4.0 |
| Not Vulnerable: |
Symantec Norton AntiVirus 5.0 Symantec Norton AntiVirus 4.0 for NT Cheyenne Inoculan for Windows NT 4.0 |
Discussion
Multiple Vendor Virus Scanner Recycle Bin Exclusion Vulnerability
Many commercial virus scanners for Windows platforms exclude the Recycled folder on the hard drive from their scans. The Recycled folder is where Win9x operating systems keep files that have been deleted via the GUI but not purged from the Recycle Bin. Files of any nature can be manually placed in the Recycled folder. Therefore, it is possible for any user or program to put code into that folder that will never be subject to virus scans.
Although WinNT makes use of a folder called 'Recycler' for similar purposes, many virus scanners for NT still have the 'Recycled' folder listed in the exclusions.
Note that other virus scanners than those listed under the 'info' tab may be vulnerable as well.
Many commercial virus scanners for Windows platforms exclude the Recycled folder on the hard drive from their scans. The Recycled folder is where Win9x operating systems keep files that have been deleted via the GUI but not purged from the Recycle Bin. Files of any nature can be manually placed in the Recycled folder. Therefore, it is possible for any user or program to put code into that folder that will never be subject to virus scans.
Although WinNT makes use of a folder called 'Recycler' for similar purposes, many virus scanners for NT still have the 'Recycled' folder listed in the exclusions.
Note that other virus scanners than those listed under the 'info' tab may be vulnerable as well.
Exploit / POC
Multiple Vendor Virus Scanner Recycle Bin Exclusion Vulnerability
This exploit will install a 'decoy' executable to the desktop, and install a file (winsetup.dll) containing an eicar.com virus signature into the Recycled folder. The hostile code is originally XORed with 25 to get it past active detection, but is then restored to its regular executable state after being placed into the recycled folder.
The zip file contains the executable exploit, and source for the installer and the decoy.
This exploit will install a 'decoy' executable to the desktop, and install a file (winsetup.dll) containing an eicar.com virus signature into the Recycled folder. The hostile code is originally XORed with 25 to get it past active detection, but is then restored to its regular executable state after being placed into the recycled folder.
The zip file contains the executable exploit, and source for the installer and the decoy.
Solution / Fix
Multiple Vendor Virus Scanner Recycle Bin Exclusion Vulnerability
Solution:
Remove '\Recycled' from the exclusion list of you antivirus software.
Each vendor has a different mechanism for editing the exclusion list.
NAI / McAffee:
There is an 'Exclusions' tab in the settings. From there you can delete the entry for the '\Recycled folder.
Symantec NAV2000:
There is no option in the interface to remove the Recycled folder from the exclusion list. To do this, you need to use a hex editor to remove the string from the 'exclude.dat' file. Max Vision has created an exclude.dat file with the Recycled folder removed, it is available at:
http://www.securityfocus.com/data/vulnerabilities/patches/exclude.dat
or
http://maxvision.net/nav/exclude.dat
Note: This patch will reset all other exclusion settings to the default values. See Max Vision's bugtraq post (linked to in the 'credit' section) for more information.
Solution:
Remove '\Recycled' from the exclusion list of you antivirus software.
Each vendor has a different mechanism for editing the exclusion list.
NAI / McAffee:
There is an 'Exclusions' tab in the settings. From there you can delete the entry for the '\Recycled folder.
Symantec NAV2000:
There is no option in the interface to remove the Recycled folder from the exclusion list. To do this, you need to use a hex editor to remove the string from the 'exclude.dat' file. Max Vision has created an exclude.dat file with the Recycled folder removed, it is available at:
http://www.securityfocus.com/data/vulnerabilities/patches/exclude.dat
or
http://maxvision.net/nav/exclude.dat
Note: This patch will reset all other exclusion settings to the default values. See Max Vision's bugtraq post (linked to in the 'credit' section) for more information.
References
Multiple Vendor Virus Scanner Recycle Bin Exclusion Vulnerability
References:
References: