HTTP: Multiple Vendor AV Gateway Virus Detection Bypass

A virus detection bypass vulnerability has been found in multiple Anti-virus Gateway products. The anti-virus scanning mechanisms of affected products encoded data embedded in an HTML document using the data: scheme. An attacker can exploit this flaw to deliver malicious content in HTML documents. The vulnerable application will not exhibit any unusual behaviour during a successful attack. The malicious content will pass unchecked through the scanning mechanisms of a vulnerable product.

Extended Description

Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs. A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness. This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.

Affected Products

Mandriva corporate_server

References

BugTraq: 12269

CVE: CVE-2005-0218

Short Name

HTTP:STC:AV-GATEWAY-BYPASS

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Multiple Vendor AV Gateway Virus Detection Bypass

Extended Description

Affected Products

References

Found a potential security threat?