Network Security: Detailed info on [Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulner

Subject:	[Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulnerability
Date:	Mon, 10 Jan 2005 14:08:11 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Multi-vendor AV gateway image inspection bypass vulnerability
January 10, 2005

A vulnerability has been discovered which allows a remote attacker to bypass anti-virus (as well other security technologies such as IDS and IPS) inspection of HTTP image content.

By leveraging techniques described in RFC 2397 for base64 encoding image content within the URL scheme. A remote attack may encode a malicious image within the body of an HTML formatted document to circumvent content inspection.

For example:

http://www.k-otik.com/exploits/09222004.ms04-28-cmd.c.php

The source code at the URL above will by default create a JPEG image that will attempt (and fail without tweaking) to exploit the Microsoft MS04-028 GDI+ vulnerability. The image itself is detected by all AV gateway engines tested (Trend, Sophos and McAfee), however, when the same image is base64 encoded using the technique described in RFC 2397 (documented below), inspection is not performed and is delivered rendered by the client.

While Microsoft Internet Explorer does not support the RFC 2397 URL scheme; Firefox, Safari, Mozilla and Opera do and will render the data and thus successfully execute the payload if the necessary OS and/or application patches have not been applied.


## BEGIN HTML ##

## END HTML ##


Solution:

While AV vendor patches are not yet available, fixes for all currently known image vulnerabilities are and have been for several months. If you have not yet applied them, you have your own negligence to blame.


Contributions:

Thanks to Scott Roeder and Jacinto Rodriquez their assistance in platform testing.


Thank you,

Darren Bounds
Intrusense, LLC.
http://www.intrusense.com

- --
Intrusense - Securing Business As Usual
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFB4tKesvxTSz2eaa8RAluUAKDmUsM6Hf+U321P/kALTC/rKwoLOwCfaK57
XT6MWYJOH3FmLfV3B1UfuJA=
=82yy
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

<Prev in Thread]	Current Thread	[Next in Thread>
[Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulnerability, Darren Bounds <= Re: [Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulnerability, Danny

Previous by Date:	iDEFENSE Security Advisory [IDEF0731] Exim auth_spa_server() Buffer Overflow Vulnerability, customer service mailbox
Next by Date:	[Full-Disclosure] [AppSecInc Team SHATTER Security Advisory] Microsoft Windows Improper Token Validation, Team SHATTER (Application Security, Inc.)
Previous by Thread:	iDEFENSE Security Advisory [IDEF0731] Exim auth_spa_server() Buffer Overflow Vulnerability, customer service mailbox
Next by Thread:	Re: [Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulnerability, Danny
Indexes:	[Date] [Thread] [Top] [All Lists]