Short Name |
HTTP:STC:AV-GATEWAY-BYPASS |
---|---|
Severity |
Minor |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Multiple Vendor AV Gateway Virus Detection Bypass |
Release Date |
2012/01/09 |
Update Number |
2060 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
A virus detection bypass vulnerability has been found in multiple Anti-virus Gateway products. The anti-virus scanning mechanisms of affected products encoded data embedded in an HTML document using the data: scheme. An attacker can exploit this flaw to deliver malicious content in HTML documents. The vulnerable application will not exhibit any unusual behaviour during a successful attack. The malicious content will pass unchecked through the scanning mechanisms of a vulnerable product.
Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs. A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness. This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.