Apache-Talk @lexa.ru 

Inet-Admins @info.east.ru 

Filmscanners @halftone.co.uk 

Security-alerts @yandex-team.ru 

nginx-ru @sysoev.ru 

   


   


   

















      :: Security-alerts
Security-Alerts mailing list archive (security-alerts@yandex-team.ru)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[security-alerts] FW: [SA17186] AVG Anti-Virus Engine Malformed ARJ Archive Virus Detection Bypass



> 
> 
> TITLE:
> AVG Anti-Virus Engine Malformed ARJ Archive Virus Detection Bypass
> 
> SECUNIA ADVISORY ID:
> SA17186
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/17186/
> 
> CRITICAL:
> Not critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> AVG Antivirus Server
> http://secunia.com/product/337/
> 
> DESCRIPTION:
> fRoGGz has discovered a weakness in AVG Anti-Virus scan engine, which
> can be exploited by malware to bypass certain scanning functionality.
> 
> For more information:
> SA17126
> 
> The weakness has been confirmed in AVG Email Server Edition version
> 7.0.344 (267.11.14/131) when scanning an email containing a malformed
> ".arj" archive with a NULL character prepended to the header. Other
> versions may also be affected.
> 
> NOTE: This is not an issue on client systems, as the malware is still
> detected upon execution by the desktop on-access scanner.
> 
> SOLUTION:
> Desktop on-access scanner should be used to ensure that the malware
> is detected upon extraction.
> 
> Filter all compressed file archives at border gateways if they are
> not required.
> 
> PROVIDED AND/OR DISCOVERED BY:
> fRoGGz, SecuBox Labs
> 
> OTHER REFERENCES:
> SA17126:
> http://secunia.com/advisories/17126/
> 




 




Copyright © Lexa Software, 1996-2009.