[security-alerts] FW: [SA17126] avast! Anti-Virus Engine Malformed ZIP/CAB Archive Virus Detection Bypass

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> avast! Anti-Virus Engine Malformed ZIP/CAB Archive Virus Detection
> Bypass
> 
> SECUNIA ADVISORY ID:
> SA17126
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/17126/
> 
> CRITICAL:
> Not critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> avast! for Kerio 4.x
> http://secunia.com/product/5852/
> 
> DESCRIPTION:
> fRoGGz has discovered a weakness in avast! Anti-Virus scan engine,
> which can be exploited by malware to bypass certain scanning
> functionality.
> 
> The weakness is caused due to an error in parsing certain malformed
> archives and can be exploited via a specially crafted archive with
> additional characters prepended to the header. Such malformed
> archives can be correctly extracted by some archiving software.
> 
> Successful exploitation allows malware packed in malformed archives
> to pass the email anti-virus scanning gateway undetected.
> 
> The weakness has been confirmed in avast! for Kerio version 4.6.313
> (Vps 0541-1) when scanning an email containing malformed ".zip" and
> ".cab" archives. Other versions may also be affected.
> 
> NOTE: This is not an issue on client systems, as the malware is still
> detected upon execution by the desktop on-access scanner.
> 
> SOLUTION:
> Desktop on-access scanner should be used to ensure that the malware
> is detected upon extraction.
> 
> Filter all compressed file archives at border gateways if they are
> not required.
> 
> PROVIDED AND/OR DISCOVERED BY:
> fRoGGz, SecuBox Labs
> 
> ORIGINAL ADVISORY:
> http://shadock.net/secubox/AVCraftedArchive.html
> 
> ----------------------------------------------------------------------