HTTP: Multiple Vendor Anti-Virus Magic Byte Detection Evasion

This signature detects attempts to exploit a known vulnerability against Multiple Anti-Virus products. Attackers can bypass the security restrictions of a system allowing the attacker to carry on future attacks on the victim's computer.

Extended Description

Multiple vendor anti-virus software is prone to a detection evasion vulnerability. The problem presents itself in the way various anti-virus software determines the type of file it is scanning. An attacker can exploit this vulnerability to pass malicious files passed the anti-virus software. This results in a false sense of security, and ultimately could lead to the execution of arbitrary code on the victim user's machine.

Affected Products

Ikarus ikarus

References

BugTraq: 15189

Short Name

HTTP:STC:AV-MAGIC-EVADE

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Multiple Vendor Anti-Virus Magic Byte Detection Evasion

Extended Description

Affected Products

References

Found a potential security threat?