[35843] in bugtraq
Re: eSafe: Could this be exploited?
daemon@ATHENA.MIT.EDU (3APA3A)
Sat Jul 24 12:57:58 2004
Date: Sat, 24 Jul 2004 15:27:43 +0400
From: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Reply-To: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Message-ID: <18610004519.20040724152743@SECURITY.NNOV.RU>
To: Hugo van der Kooij <hvdkooij@vanderkooij.org>
Cc: bugtraq@securityfocus.com
In-Reply-To: <Pine.LNX.4.58.0407232006590.12722@gandalf.hugo.vanderkooij.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: 8bit
Dear Hugo van der Kooij,
--Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq@securityfocus.com:
HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the
HvdK> end-user before they stop a virus. Then they rely on the adding of the
HvdK> exact URL so that URL can be blocked in all next requests.
It depends on how antiviral check is actually implemented. If connection
is broken immediately after signature is detected - there is no way to
download infected file, because signature will not pass to client and
client will not be able to use "Range:" header to resume partially
downloaded file.
If antiviral filter checks data _after_ all data received from client
with 20% buffering yes, it's possible to bypass this check for HTTP,
because there is no way (at least for HTTP/1.0 and FTP) to indicate
error to client and make him to delete partially downloaded data.
You can check it, by sending EICAR with some additional data: if you can
find EICAR signature on the client after connection is broken by
antiviral filter you can bypass it's protection.
--
~/ZARAZA
Машина оказалась способной к единственному действию,
а именно умножению 2x2, да и то при этом ошибаясь. (Лем)
