Clam AntiVIrus Generic Bypass Using RAR CAB or ZIP Files
17 Jun. 2009
Summary
The parsing engine can be bypassed by manipulating RAR,ZIP archives in a "certain way" that the Clamav engine cannot extract the content but the end user is able to.
Vulnerable Systems:
* ClamAV prior to version 0.95.2
Immune Systems:
* ClamAV version 0.95.2 and later
In essence a bypass is simple to understand - the AV scanning engine, that is the logic and code paths that detect if code is malicious or not, are evaded. This is not to be confused with the manipulation of existing malware in order to be no longer detected - these could be consider an "evasion" but only for that single sample - Thierry does not consider these to be a security problem per se.
Evasions presented here are generic, meaning that they represent a generic method to evade detection .
