Re[2]: Multiple Vendor Unusual MIME Encoding Content Filter Bypass

2006-12-08T00:00:00
ID SECURITYVULNS:DOC:15328
Type securityvulns
Reporter Securityvulns
Modified 2006-12-08T00:00:00

Description

Dear Tomasz Kojm,

TK> That's extremely irresponsible to disclose bugs without giving the vendors TK> any chance to fix them and prepare new software releases.

This is a rare case I can not agree with such statement.

Ability to bypass content filter is not a bug before this issues is used in-the-wild, like ability to write undetectable virus is not a bug in antivirus. It may be simply impossible to find all vendors and wait for all fixes.

Ability to bypass content filter is a common case, especially for "passive" filters not changing message content. It arises from the fact different client applications and different content filters use different algorithms. It's possible to create message with "fork": if you make one assumption you miss attachment for Microsoft, if another - you miss attachment for Mozilla. It's simply impossible to find malware for all possible clients without normalization of the message. Message normalization may, in it's turn, break digital signatures.

This problems and known methods of bypassing are discussed here: http://www.security.nnov.ru/advisories/content.asp

I regularly update this whitepaper with newly discovered methods. Please report if you know any content filtering bypassing method I missed.

--Thursday, December 7, 2006, 5:15:50 PM, you wrote to hendrik@enyo.de:

>> Several e-mail virus scanners can be tricked into passing an EICAR >> test file if the following conditions are met: >> >> 1. the EICAR file is encoded in Base64 including characters not in the >> standard alphabet (e.g. whitespaces) and >> 2. the part containing the EICAR file is nested within one or several >> levels of multipart/mixed content. >> >> Details and PoC can be found at: >> http://www.quantenblog.net/security/virus-scanner-bypass

TK> That's extremely irresponsible to disclose bugs without giving the vendors TK> any chance to fix them and prepare new software releases.

-- ~/ZARAZA Патриотизм - это та же религия. (Твен)