CVE-2012-1436

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \2D\6C\68...

CVE-2012-1445

The CVE-2012-1445 entry concerns the ELF file parser in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7. According to the records, remote attackers can bypass malware detection by submitting an ELF file with a modified abi field. The availa...

CVE-2012-1444

The CVE-2012-1444 entry concerns the ELF file parser logic in eSafe 7.0.17.0, Prevx 3.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 where a modified ELF abiversion field allows remote attackers to bypass malware detection. The available documents indicate affected products and the...

CVE-2012-1440

The CVE affects the ELF file parser in Norman Antivirus 6.06.12, eSafe 7.0.17.0, CA eTrust Vet Antivirus 36.1.8511, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7. A modified identsize field in ELF files allows remote attackers to bypass malware detection, per the description. This do...

CVE-2012-1441

The Microsoft EXE file parser in eSafe 7.0.17.0 and Prevx 3.0 allows remote attackers to bypass malware detection via an EXE file with a modified value in any of several e fields. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurr...

CVE-2012-1435

The CVE-2012-1435 entry describes a vulnerability in the Microsoft EXE file parser used by several antivirus products (AhnLab V3 Internet Security, Emsisoft Anti-Malware, eSafe, Ikarus, Panda Antivirus). The vulnerability allows remote attackers to bypass malware detection when processing an EXE ...

CVE-2008-5528

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

Design/Logic Flaw

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5528

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5528

CVE-2008-5528 describes a bypass of malware detection in HTML documents when using Internet Explorer 6/7, by prepending an MZ header (“EXE info”) and renaming the document’s filename to have no extension, .txt, or .jpg. Connected documents (e.g., CVE-2006-5745) confirm the same pattern affecting ...

CVE-2003-1449

Affected product: Aladdin Knowledge Systems eSafe Gateway 3.5.126.0. Issue: CVP data stream incomplete validation allows remote attackers to bypass virus protection. Root cause: CVP data is not checked in full. Impact (per sources): partial confidentiality, integrity, and availability; CVSS v2 ba...

CVE-2003-1449

Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol CVP data, which allows remote attackers to bypass virus protection...

CVE-2003-1449

Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol CVP data, which allows remote attackers to bypass virus protection...

Vendor Response to - eSafe gateway and Check Point FW-1 protection bypass

Dear Sirs, We would like to comment about a security alert published on your site. An alert regarding Aladdin eSafe Gateway for CVP was published by you: http://www.security.nnov.ru/search/news.asp?binid=2572 The alert was picked up from the original Russian submission without being verified with...

eSafe gateway and Check Point FW-1 protection bypass

Archives packed with lates RA version are not checked...

eSafe gateway fails to catch virii if used in CVP

Subject: eSafe gateway fails to catch virii if used in CVP Affected: eSafe gateway v3.5.126.0 Vendor: Aladdin Knowlege Systems Author: Igor U.Miturin [email protected] Date: February, 5 2003 Risk: Average Vendor Notified: No I. Intro eSafe gateway is a suite of content filtering product...

CVE-2001-0519

Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags...

CVE-2001-0521

Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document...

CVE-2001-0520

Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including 1 onload in the BODY tag, 2 href in the A tag, 3 the BUTTON tag, 4 the INPUT tag, or 5 any other tag in which scripts can be...

CVE-2001-0521

CVE-2001-0521 affects Aladdin eSafe Gateway versions 3.0 and earlier. The issue allows a remote attacker to bypass the gateway’s HTML SCRIPT filtering by using Unicode-encoded SCRIPT tags within the HTML document. This describes a filtering bypass in the web gateway; the documents do not provide ...