|
Brought to you by:
Suppliers of:
|
|
|
| |
| The parsing engine can be bypassed by a specially crafted and formated RAR (Headflags and Packsize),ZIP (Filelenght) and CAB (Filesize) archive. |
| |
Credit:
The information has been provided by Thierry Zoller.
|
| |
Vulnerable Systems:
* IKARUS virus utilities
* IKARUS myM@ilWall
* IKARUS Content Wall
* IKARUS security.proxy
Immune Systems:
* IKARUS engine version 1.1.58
The bug results in denying the engine the possibility to inspect code within the CAb,RAR,ZIP archives. There is no inspection of content at all.
A general description of the impact and nature of AV Bypasses/evasions can be read at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
Disclosure Timeline:
23/03/2009 : Send proof of concept (ZIP), description the terms under which I cooperate and the planned disclosure date.
04/04/2009 : Send proof of concept (RAR)
07/04/2009 : Ikarus acknowledges receipt, patching Dev builds has begun 10/04/2009 : Resending ZIP PoC
13/04/2009 : Submitting CAB PoC
17/04/2009 : Ikarus demands to delay disclosure
01/05/2009 : Ikarus states that it has started Q&A for the new builds
03/06/2009 : Ikarus informs me that they started deploying the patches/updates Credit will be given on a website to come.
09/06/2009 : Release of this advisory.
|
|
|
|
|
