CVE-2012-1442

The CVE-2012-1442 entry concerns an ELF file parser flaw that affects multiple antivirus products (e.g., Quick Heal/Cat QuickHeal 11.00, McAfee AV/Engine 5.400.0.1158, McAfee Gateway 2010.1C, eSafe 7.0.17.0, Kaspersky 7.0.0.125, F-Secure 9.0.16160.0, Sophos 4.61.0, AVL SDK 2.0.3.7, Rising 22.83.0...

CVE-2012-1444

The CVE-2012-1444 entry concerns the ELF file parser logic in eSafe 7.0.17.0, Prevx 3.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 where a modified ELF abiversion field allows remote attackers to bypass malware detection. The available documents indicate affected products and the...

CVE-2012-1436

The CVE-2012-1436 entry concerns the Microsoft EXE file parser used by multiple anti-malware products: AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7. The flaw allows r...

CVE-2012-1454

The CVE-2012-1454 entry notes that the ELF file parser in Dr.Web 5.0.2.03300, eSafe 7.0.17.0, McAfee Gateway (Webwasher) 2010.1C, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 can be bypassed by a modified ei_version field in an ELF file, enabling a remo...

CVE-2012-1430

The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway formerly Webwasher 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03...

CVE-2012-1431

CVE-2012-1431 covers a vulnerability in the ELF file parser used by multiple antivirus products (Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo 7424, eSafe 7.0.17.0, F-Prot 4.6.2.117, F-Secure 9.0.16160.0, McAfee Gateway/Webwasher 2010.1C, nProtect 2011-01-17.01, Sophos 4.61.0, Rising 22.83....

CVE-2008-5528

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

Design/Logic Flaw

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5528

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5528

CVE-2008-5528 describes a bypass of malware detection in HTML documents when using Internet Explorer 6/7, by prepending an MZ header (“EXE info”) and renaming the document’s filename to have no extension, .txt, or .jpg. Connected documents (e.g., CVE-2006-5745) confirm the same pattern affecting ...

CVE-2003-1449

Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol CVP data, which allows remote attackers to bypass virus protection...

CVE-2003-1449

Affected product: Aladdin Knowledge Systems eSafe Gateway 3.5.126.0. Issue: CVP data stream incomplete validation allows remote attackers to bypass virus protection. Root cause: CVP data is not checked in full. Impact (per sources): partial confidentiality, integrity, and availability; CVSS v2 ba...

CVE-2003-1449

Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol CVP data, which allows remote attackers to bypass virus protection...

Vendor Response to - eSafe gateway and Check Point FW-1 protection bypass

Dear Sirs, We would like to comment about a security alert published on your site. An alert regarding Aladdin eSafe Gateway for CVP was published by you: http://www.security.nnov.ru/search/news.asp?binid=2572 The alert was picked up from the original Russian submission without being verified with...

eSafe gateway and Check Point FW-1 protection bypass

Archives packed with lates RA version are not checked...

eSafe gateway fails to catch virii if used in CVP

Subject: eSafe gateway fails to catch virii if used in CVP Affected: eSafe gateway v3.5.126.0 Vendor: Aladdin Knowlege Systems Author: Igor U.Miturin [email protected] Date: February, 5 2003 Risk: Average Vendor Notified: No I. Intro eSafe gateway is a suite of content filtering product...

CVE-2001-0519

Aladdin eSafe Gateway versions 2.x allows a remote attacker to circumvent HTML SCRIPT filtering via a special arrangement of HTML tags which includes SCRIPT tags embedded within other SCRIPT tags...

CVE-2001-0521

Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent HTML SCRIPT filtering via the UNICODE encoding of SCRIPT tags within the HTML document...

CVE-2001-0520

Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including 1 onload in the BODY tag, 2 href in the A tag, 3 the BUTTON tag, 4 the INPUT tag, or 5 any other tag in which scripts can be...

CVE-2001-0520

Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including 1 onload in the BODY tag, 2 href in the A tag, 3 the BUTTON tag, 4 the INPUT tag, or 5 any other tag in which scripts can be...