[35852] in bugtraq
Re: eSafe: Could this be exploited?
daemon@ATHENA.MIT.EDU (MegaHz)
Mon Jul 26 16:37:01 2004
Message-ID: <8ced05f50407252226575ec4f9@mail.gmail.com>
Date: Mon, 26 Jul 2004 08:26:16 +0300
From: MegaHz <megahz@gmail.com>
To: bugtraq@securityfocus.com
Cc: Hugo van der Kooij <hvdkooij@vanderkooij.org>,
3APA3A <3apa3a@security.nnov.ru>
In-Reply-To: <18610004519.20040724152743@SECURITY.NNOV.RU>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
I have tested it out, and esafe blocked the hole email that contains
the eicar virus.
Of course I have configure esafe to block virus infected emails
instead of modifying them and removing the virus.
MegaHz
www.megahz.org
megahz@megahz.org
On Sat, 24 Jul 2004 15:27:43 +0400, 3APA3A <3apa3a@security.nnov.ru> wrote:
> Dear Hugo van der Kooij,
>
> --Friday, July 23, 2004, 10:21:22 PM, you wrote to bugtraq@securityfocus.com:
>
> HvdK> Both as NitroEngine or CVP server they will push as much of 80% to the
> HvdK> end-user before they stop a virus. Then they rely on the adding of the
> HvdK> exact URL so that URL can be blocked in all next requests.
>
> It depends on how antiviral check is actually implemented. If connection
> is broken immediately after signature is detected - there is no way to
> download infected file, because signature will not pass to client and
> client will not be able to use "Range:" header to resume partially
> downloaded file.
>
> If antiviral filter checks data _after_ all data received from client
> with 20% buffering yes, it's possible to bypass this check for HTTP,
> because there is no way (at least for HTTP/1.0 and FTP) to indicate
> error to client and make him to delete partially downloaded data.
>
> You can check it, by sending EICAR with some additional data: if you can
> find EICAR signature on the client after connection is broken by
> antiviral filter you can bypass it's protection.
>
> --
> ~/ZARAZA
> Машина оказалась способной к единственному действию,
> а именно умножению 2x2, да и то при этом ошибаясь. (Лем)
>
>
