exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

CA Anti-Virus Engine Detection Evasion

CA Anti-Virus Engine Detection Evasion
Posted Jan 28, 2009
Authored by Ken Williams | Site www3.ca.com

The CA Anti-Virus engine contains multiple vulnerabilities that can allow a remote attacker to evade detection by the Anti-Virus engine by creating a malformed archive file in one of several common file archive formats.

tags | advisory, remote, vulnerability, virus
advisories | CVE-2009-0042
SHA-256 | 944ae526a24c8cceb81b918075140aa5750f12966e49907a39066cac40a142ce

CA Anti-Virus Engine Detection Evasion

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Title: CA20090126-01: CA Anti-Virus Engine Detection Evasion
Multiple Vulnerabilities


CA Advisory Reference: CA20090126-01


CA Advisory Date: 2009-01-26


Reported By:
Thierry Zoller and Sergio Alvarez of n.runs AG


Impact: A remote attacker can evade detection.


Summary: The CA Anti-Virus engine contains multiple
vulnerabilities that can allow a remote attacker to evade
detection by the Anti-Virus engine by creating a malformed archive
file in one of several common file archive formats. CA has
released a new Anti-Virus engine to address the vulnerabilities.
The vulnerabilities, CVE-2009-0042, are due to improper handling
of malformed archive files by the Anti-Virus engine. A remote
attacker can create a malformed archive file that potentially
contains malware and evade anti-virus detection.

Note: After files have been extracted from an archive, the desktop
Anti-Virus engine is able to scan all files for malware.
Consequently, detection evasion can be a concern for gateway
anti-virus software if archives are not scanned, but the risk is
effectively mitigated by the desktop anti-virus engine.


Mitigating Factors: See note above.


Severity: CA has given these vulnerabilities a Low risk rating.


Affected Products:
CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1,
r8, r8.1
CA Anti-Virus 2007 (v8), 2008
eTrust EZ Antivirus r7, r6.1
CA Internet Security Suite 2007 (v3), 2008
CA Internet Security Suite Plus 2008
CA Threat Manager for the Enterprise (formerly eTrust Integrated
Threat Management) r8, 8.1
CA Anti-Virus Gateway (formerly eTrust Antivirus Gateway) 7.1
CA Protection Suites r2, r3, r3.1
CA Secure Content Manager (formerly eTrust Secure Content
Manager) 8.0, 8.1
CA Anti-Spyware for the Enterprise (Formerly eTrust
PestPatrol) r8, 8.1
CA Anti-Spyware 2007, 2008
CA Network and Systems Management (NSM) (formerly Unicenter
Network and Systems Management) r3.0, r3.1, r11, r11.1
CA ARCserve Backup r11.1, r11.5, r12 on Windows
CA ARCserve Backup r11.1, r11.5 Linux
CA ARCserve client agent for Windows
CA eTrust Intrusion Detection 2.0 SP1, 3.0, 3.0 SP1, 4.0
CA Common Services (CCS) r11, r11.1
CA Anti-Virus SDK (formerly eTrust Anti-Virus SDK)


Non-Affected Products:
CA Anti-Virus engine with arclib version 7.3.0.15 installed


Affected Platforms:
Windows
UNIX
Linux
Solaris
Mac OS X
NetWare


Status and Recommendation:
CA released arclib 7.3.0.15 in September 2008. If your product is
configured for automatic updates, you should already be protected,
and you need to take no action. If your product is not configured
for automatic updates, then you simply need to run the update
utility included with your product.


How to determine if you are affected:

For products on Windows:

1. Using Windows Explorer, locate the file "arclib.dll". By
default, the file is located in the
"C:\Program Files\CA\SharedComponents\ScanEngine" directory (*).
2. Right click on the file and select Properties.
3. Select the Version tab.
4. If the file version is earlier than indicated below, the
installation is vulnerable.

File Name File Version
arclib.dll 7.3.0.15

*For eTrust Intrusion Detection 2.0 the file is located in
"Program Files\eTrust\Intrusion Detection\Common", and for eTrust
Intrusion Detection 3.0 and 3.0 sp1, the file is located in
"Program Files\CA\Intrusion Detection\Common".

For CA Anti-Virus r8.1 on non-Windows platforms:

Use the compver utility provided on the CD to determine the
version of Arclib. If the version is less than 7.3.0.15, the
installation is vulnerable.

Example compver utility output:
------------------------------------------------
COMPONENT NAME VERSION
------------------------------------------------
eTrust Antivirus Arclib Archive Library 7.3.0.15
... (followed by other components)

For reference, the following are file names for arclib on
non-Windows operating systems:

Operating System File name
Solaris libarclib.so
Linux libarclib.so
Mac OS X arclib.bundle


Workaround:
Do not open email attachments or download files from untrusted
sources.


References (URLs may wrap):
CA Support:
http://support.ca.com/
CA20090126-01: Security Notice for CA Anti-Virus Engine
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1976
01
Solution Document Reference APARs:
n/a
CA Security Response Blog posting:
CA20090126-01: CA Anti-Virus Engine Detection Evasion Multiple
Vulnerabilities
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/26.aspx
Reported By:
Thierry Zoller and Sergio Alvarez of n.runs AG
http://www.nruns.com/
http://secdev.zoller.lu
CVE References:
CVE-2009-0042 - Anti-Virus detection evasion
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0042
OSVDB References: Pending
http://osvdb.org/


Changelog for this advisory:
v1.0 - Initial Release


Customers who require additional information should contact CA
Technical Support at http://support.ca.com.

For technical questions or comments related to this advisory,
please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your
findings to the CA Product Vulnerability Response Team.
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=1777
82


Regards,
Ken Williams, Director ; 0xE2941985
CA Product Vulnerability Response Team


CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/
Legal Notice http://www.ca.com/us/legal/
Privacy Policy http://www.ca.com/us/privacy/
Copyright (c) 2009 CA. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.9.1 (Build 287)
Charset: utf-8

wj8DBQFJfyMKeSWR3+KUGYURAkyRAJ94Db9OT0mSDBo8UiSAK7AWWt5XSgCfc89J
SlKLxRwfw06DmTk2tmlcrJI=
=Kjse
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close