Re: Unfiltered escape sequences in filenames contained in ZIP archives wouldn't be escaped on displaying or logging, and can also lead to bypass AV scanning
Dear List,
Updated: State as of 15/03/2005
From ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/
File unfiltered-escape-sequences-in-filename-eicar.zip
-------------------------------------------------------------------
AntiVir : Eicar-Test-Signature
Avast : EICAR Test-NOT!!
AVG Antivirus : No viruses found
BitDefender : EICAR-Test-File (not a virus) (0.52 seconds taken)
ClamAV : Eicar-Test-Signature (0.59 seconds taken)
Dr.Web : EICAR Test File (NOT a Virus!) (0.90 seconds taken)
F-Prot Antivirus : EICAR_Test_File (0.29 seconds taken)
Fortinet : EICAR_TEST_FILE (1.20 seconds taken)
Kaspersky Anti-Virus : EICAR-Test-File (3.04 seconds taken)
mks_vir : Eicar.Test (probable variant) (0.70 seconds taken)
NOD32 : Eicar test file (1.55 seconds taken)
Norman Virus Control : EICAR_Test_file_not_a_virus! (0.48 seconds taken)
-------------------------------------------------------------------
Result: AVG fails.
From ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/
File unfiltered-escape-sequences-in-filename-sober.l.zip
-------------------------------------------------------------------
AntiVir : Worm/Sober.L (0.42 seconds taken)
Avast : Win32:Sober-K (1.53 seconds taken)
AVG Antivirus : No viruses found (0.52 seconds taken)
BitDefender : Win32.Sober.L@mm (0.53 seconds taken)
ClamAV : Worm.Sober.L (0.60 seconds taken)
Dr.Web : Win32.HLLM.Generic.328 (0.94 seconds taken)
F-Prot Antivirus : W32/Sober.M@mm (0.09 seconds taken)
Fortinet : W32/Sober.M-mm (0.45 seconds taken)
Kaspersky Anti-Virus : Email-Worm.Win32.Sober.l (1.03 seconds taken)
mks_vir : Worm.Sober.L (0.24 seconds taken)
NOD32 : Win32/Sober.L (0.48 seconds taken)
Norman Virus Control : Sober.L@mm (0.18 seconds taken)
-------------------------------------------------------------------
Result: AVG fails.
From ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/
File no-escape-sequences-in-filename-eicar.zip
-------------------------------------------------------------------
AntiVir : Eicar-Test-Signature (0.38 seconds taken)
Avast : EICAR Test-NOT!! (1.52 seconds taken)
AVG Antivirus : EICAR_Test (0.52 seconds taken)
BitDefender : EICAR-Test-File (not a virus) (0.52 seconds taken)
ClamAV : Eicar-Test-Signature (0.59 seconds taken)
Dr.Web : EICAR Test File (NOT a Virus!) (0.90 seconds taken)
F-Prot Antivirus : EICAR_Test_File (0.09 seconds taken)
Fortinet : EICAR_TEST_FILE (0.45 seconds taken)
Kaspersky Anti-Virus : EICAR-Test-File (1.00 seconds taken)
mks_vir : Eicar.Test (probable variant) (0.23 seconds taken)
NOD32 : Eicar test file (0.47 seconds taken)
Norman Virus Control : EICAR_Test_file_not_a_virus! (0.18 seconds taken)
-------------------------------------------------------------------
Results: No failures.
From ftp://ftp.aerasec.de/pub/advisories/unfiltered-escape-sequences/
File no-escape-sequences-in-filename-sober.l.zip
-------------------------------------------------------------------
Short version : Results: No failures.
-------------------------------------------------------------------
visitbipin@xxxxxxxxx posted this POC (over FD)
http://www.geocities.com/visitbipin/test_nav.zip
AntiVir : Eicar-Test-Signature
Avast : EICAR Test-NOT!!
AVG Antivirus : EICAR_Test
BitDefender : EICAR-Test-File
ClamAV : No viruses found
Dr.Web : EICAR Test File
F-Prot Antivirus : No viruses found
Fortinet : No viruses found
Kaspersky Anti-Virus : EICAR-Test-File
mks_vir : Eicar.Test (probable variant)
NOD32 : No viruses found
Norman Virus Control : No viruses found
---------------------------------------------------
visitbipin@xxxxxxxxxxx posted this POC
http://www.geocities.com/visitbipin/gpbf.zip
AntiVir : No viruses found
Avast : EICAR Test-NOT!!
AVG Antivirus : EICAR_Test
BitDefender : EICAR-Test-File (not a virus)
ClamAV : Eicar-Test-Signature
Dr.Web : EICAR Test File (NOT a Virus!)
F-Prot Antivirus : No viruses found
Fortinet : EICAR_TEST_FILE
Kaspersky Anti-Virus : No viruses found
mks_vir : No viruses found
NOD32 : Eicar test file
Norman Virus Control : No viruses found
-------------------------------------------------------------------
Results: Archives modified by visitbipin@xxxxxxxxxxx fail on more
scanners. Why, I ignore.
--
Thierry Zoller
mailto:Thierry@xxxxxxxxxxxx