<<< Date Index >>>     <<< Thread Index >>>

Av issues



In-Reply-To: <20050311203150.17236.qmail@xxxxxxxxxxxxxxxxxxxxx>

In Local file header if you modify "general purpose bit flag" 7th & 8'th byte 
of a zip archive with \x2f ie: "\" F-port, Kaspersky, Mcafee, Norman, Sybari, 
Symantec seem to skip the file marking it as clean!!! This was discovered 
during the analysis of "Multiple AV Vendor Incorrect CRC32 Bypass 
Vulnerability."
Quick/rough conclusion were drawn using www.virustotal.com

poc: http://www.geocities.com/visitbipin/gpbf.zip

Well, tested with F-prot, DrWeb, *Symantec 8.0 long ago... lately verified it 
using virustotal.com If you have a long archive coment... in a zip archive 
these AV can't detect virus embedded in it. I came to know Symantec 8.1 is 
immune to the bug?

POC: http://www.geocities.com/visitbipin/long_coment.zip

regards,
bipin gautam