Signature Detail

HTTP: Multiple Vendor AV Gateway Virus Detection Bypass

A virus detection bypass vulnerability has been found in multiple Anti-virus Gateway products. The anti-virus scanning mechanisms of affected products encoded data embedded in an HTML document using the data: scheme. An attacker can exploit this flaw to deliver malicious content in HTML documents. The vulnerable application will not exhibit any unusual behaviour during a successful attack. The malicious content will pass unchecked through the scanning mechanisms of a vulnerable product.

Extended Description

Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs. A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness. This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.

Affected Products

• ALT Linux ALT Linux Compact 2.3.0
• ALT Linux ALT Linux Junior 2.3.0
• Check Point Software FireWall-1 R55 HFA08 with SmartDefense
• Clam Anti-Virus ClamAV 0.51.0
• Clam Anti-Virus ClamAV 0.52.0
• Clam Anti-Virus ClamAV 0.53.0
• Clam Anti-Virus ClamAV 0.54.0
• Clam Anti-Virus ClamAV 0.60.0
• Clam Anti-Virus ClamAV 0.65.0
• Clam Anti-Virus ClamAV 0.67.0
• Clam Anti-Virus ClamAV 0.68.0
• Clam Anti-Virus ClamAV 0.68.0 -1
• Clam Anti-Virus ClamAV 0.70.0
• Clam Anti-Virus ClamAV 0.80.0
• Clam Anti-Virus ClamAV 0.80.0 Rc1
• Clam Anti-Virus ClamAV 0.80.0 Rc2
• Clam Anti-Virus ClamAV 0.80.0 Rc3
• Clam Anti-Virus ClamAV 0.80.0 Rc4
• Clam Anti-Virus ClamAV 0.81.0
• Gentoo Linux
• IBM SiteProtector 2.0.0 SP3
• IBM SiteProtector 2.0.4.561
• IronPort IronPort with Sophos AV Engine 3.88
• Mandriva Corporate Server 3.0.0
• Mandriva Corporate Server 3.0.0 X86 64
• Mandriva Linux Mandrake 10.1.0
• Mandriva Linux Mandrake 10.1.0 X86 64
• McAfee Webshield 3000 4.3.20
• TippingPoint Unity-One with Digital Vacine 2.0.0.2070
• Trend Micro InterScan Messaging Security Suite 3.81.0
• Trend Micro InterScan Messaging Security Suite 5.5.0
• Trend Micro WebProtect 3.1.0

References

• BugTraq: 12269
• CVE: CVE-2005-0218