all things security

oss-bypass.txt

oss-bypass.txt
Posted Jul 23, 2008
Authored by Juan Pablo Lopez Yacubian

Outpost Security Suite Pro version 2009 suffers from multiple bypass vulnerabilities when using special characters.

tags | exploit, vulnerability, bypass
MD5 | 7570d3a72f5096b9588136427c83cebc

oss-bypass.txt

Change Mirror Download

Application: Outpost Security Suite Pro ver. 2009
OS: Windows Xp (All patches a day)
------------------------------------------------------
1 - Description
2 - Vulnerability
3 - POC/EXPLOIT
------------------------------------------------------
Description
Outpost Security Suite is a software application that contains several security,
including anti-virus and is mainly a firewall but also includes an anti-spam and content control.

------------------------------------------------------
Vulnerability

The vulnerability is that when using certain special characters such as file name
could be left without protection for the system.

The first flaw is used as a special character file name,
making this could evade antivirus protection and make a file already detected
by the antiviru not be detected.

The second flaw is that using a certain amount of special characters such as filename to run a program
that this blocked by the firewall, the firewall to detect the file, it would break the firewall and would
continue to be running malicious file without restrictions.

In the latter case exceptions vary depending on the type of characters which are used
for example here there are two different results.

Aplicación con errores: acs.exe, versión: 6.5.2358.9115, módulo con error: ntdll.dll, versión 5.1.2600.2180, dirección de error 0x000111de.
Aplicación con errores: acs.exe, versión: 6.5.2358.9115, módulo con error: kernel32.dll, versión 5.1.2600.3119, dirección de error 0x0000bd85.
Aplicación con errores: acs.exe, versión: 6.5.2358.9115, módulo con error: firewall.ofp, versión 6.5.2358.9115, dirección de error 0x000350b3.

------------------------------------------------------
POC/EXPLOIT
To evade the virus requires the following character.

ASCII: 
HEX: 26 23 31 32 32 38 38 3b

To perform the test to fail the firewall will require the following.

ASCII:† ‡ • ‣ ․ ‥ …
HEX: 86 20 87 20 95 20 26 23 38 32 32 37 3b 20 26 23 38 32 32 38 3b 20 26 23 38 32 32 39 3b 20 85


Note: In the case of evasion of anti-virus testing must be done with a file detected by antivirus and firewall
in the case obviously does not have a file that would make connections.
------------------------------------------------------
Juan Pablo Lopez Yacubian

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close