CVE-2004-2442

Multiple interpretation error in various F-Secure Anti-Virus products, including Workstation 5.43 and earlier, Windows Servers 5.50 and earlier, MIMEsweeper 5.50 and earlier, Anti-Virus for Linux Servers and Gateways 4.61 and earlier, and other products, allows remote attackers to bypass antiviru...

CVE-2004-2405

Buffer overflow in multiple F-Secure Anti-Virus products, including F-Secure Anti-Virus 5.42 and earlier, allows remote attackers to bypass scanning or cause a denial of service crash or module restart, depending on the product, via a malformed LHA archive...

Anti-virus software may not properly scan malformed zip archives

Overview Anti-virus software may rely on corrupted headers to determine if a zip archive is valid. As a result, anti-virus software may fail to detect malicious content within a zip archive. Description Information about a zip archive, such as the size of the compressed data, is placed in headers...

CVE-2004-1098

CVE-2004-1098 affects MIME-tools (v5.414) used by MIMEDefang. The vulnerability arises from an empty boundary string in the Content-Type header, which lets a virus-infected attachment bypass some antivirus scanning. Impact is bypass of virus detection; published advisories reference MIME-tools an...

CVE-2004-1098

MIMEDefang in MIME-tools 5.414 allows remote attackers to bypass virus scanning capabilities via an e-mail attachment with a virus that contains an empty boundary string in the Content-Type header...

FreeBSD : p5-Archive-Zip -- virus detection evasion (134)

The following package needs to be updated: p5-Archive-Zip %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkga5742055300a11d9a9e70001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyrigh...

CVE-2004-0932

The CVE-2004-0932 issue affects McAfee Anti-Virus Engine DATS drivers before 4398 (and the DATS Driver before 4397). A crafted ZIP archive with both local and global headers set to zero can bypass antivirus protection and still be opened on the target system. This is a remote-exploitation-style b...

CVE-2004-0932

McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from bei...

CVE-2004-0937

Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target...

CVE-2004-0935

CVE-2004-0935 affects Eset Anti-Virus prior to 1.020. A ZIP archive with both local and global headers set to zero could bypass antivirus protection and allow a malicious file to be opened on the target system. PoC/proofs of concept code and advisories (e.g., iDEFENSE CAN references) document det...

CVE-2004-0937

CVE-2004-0937 affects Sophos Anti-Virus prior to 3.87.0 and Sophos Anti-Virus for Windows 95/98/Me prior to 3.88.0. The issue allows remote attackers to bypass antivirus protection by delivering a ZIP archive whose local and global headers are set to zero, yet the archive can still be opened on t...

CVE-2004-0935

Eset Anti-Virus before 1.020 16th September 2004 allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system...

PT-2004-1962

Name of the Vulnerable Software and Affected Versions: Eset Anti-Virus versions prior to 1.020 16th September 2004 Description: The issue allows remote attackers to bypass antivirus protection by using a compressed file with both local and global headers set to zero. This technique does not preve...

CVE-2004-1003

This CVE affects Trend Micro ScanMail for Domino. The vulnerability concerns the nsf-based component smency.nsf, enabling a remote attacker to read sensitive files and potentially disable antivirus protection. Multiple sources describe the issue as an information-disclosure flaw that could expose...

GLSA-200411-06 : MIME-tools: Virus detection evasion

The remote host is affected by the vulnerability described in GLSA-200411-06 MIME-tools: Virus detection evasion MIME-tools doesn't correctly parse attachment boundaries with an empty name boundary=''. Impact : An attacker could send a carefully crafted email and evade detection on some email...

Mandrake Linux Security Advisory : perl-Archive-Zip (MDKSA-2004:118)

Recently, it was noticed that several antivirus programs miss viruses that are contained in ZIP archives with manipulated directory data. The global archive directory of these ZIP file have been manipulated to indicate zero file sizes. Archive::Zip produces files of zero length when decompressing...

MIME-tools: Virus detection evasion

Background MIME-tools is a Perl module containing functions to handle MIME attachments. Description MIME-tools doesn't correctly parse attachment boundaries with an empty name boundary="". Impact An attacker could send a carefully crafted email and evade detection on some email virus-scanning...

Mandrake Linux Security Advisory : perl-MIME-tools (MDKSA-2004:123)

There's a bug in MIME-tools, where it mis-parses things like boundary=''. Some viruses use an empty boundary, which may allow unapproved parts through MIMEDefang. The updated packages are patched to fix this problem. As well, the Updated perl-MIME-tools requires MIME::Base64 version 3.03. Since...

GLSA-200410-31 : Archive::Zip: Virus detection evasion

The remote host is affected by the vulnerability described in GLSA-200410-31 Archive::Zip: Virus detection evasion Archive::Zip can be used by email scanning software like amavisd-new to uncompress attachments before virus scanning. By modifying the uncompressed size of archived files in the glob...

MoonLit Virus Backdoor Detection

The system is infected by the MoonLit virus, the backdoor port is open. Backdoor.Moonlit is a Trojan horse program that can download and execute files, and may act as a proxy server. Copyright C 2004-2010 KK Liu rev 1.0: MoonLit detection - 07/30/2004 rev 1.1: Description changes rev 1.2: Bug fix...