| The Vigil@nce team watches vulnerabilities impacting your computers, and then offers solutions, a database and tools to correct them. |
|
 |
|
|
|
vulnerability bulletin 8683
Trend Micro: bypassing via RAR, CAB and ZIP
Synthesis of the vulnerability
| An attacker can create a RAR, CAB or ZIP archive containing a virus which is not detected by Trend Micro. |
Severity: 2/4.
Creation date: 30/04/2009.
|
Impacted products
Description of the vulnerability
Trend Micro products detect viruses contained in RAR, CAB and ZIP archives.
However, an attacker can create a slightly malformed archive, which can still be opened by Unrar/Unzip tools, but which cannot be opened by the antivirus.
Depending on Trend Micro product, these archives are handled in three ways:
OfficeScan and ServerProtect are vulnerable when Unrar/Unzip extracts the file on the desktop computer. These products are thus vulnerable when installed on a scan server. [severity:2/4; >]
InterScan Web Security Suite and InterScan Messaging Security quarantine the file by default. These products are vulnerable if the administrator changed the default configuration. [severity:2/4; >]
ScanMail does not indicate that the unscanned archive potentially contains a virus. This product is vulnerable in its default configuration. [severity:2/4; >]
An attacker can therefore create a RAR, CAB or ZIP archive containing a virus which is not detected by Trend Micro. |
Share this bulletin
Complete Vigil@nce bulletin
Characteristics
Title: Trend Micro: bypassing via RAR, CAB and ZIP.
Keywords: CAB InterScan Messaging Micro RAR Security ServerProtect Suite Trend Unrar Unzip Web ZIP bypassing canMail fficeScan nterScan.
Identifiers: BID-34763, TZO-17-2009, VIGILANCE-VUL-8683.
|
Information sources
Solutions for this vulnerability
Supplements
Vulnerability : Trend Micro 1
OfficeScan and ServerProtect are vulnerable when Unrar/Unzip extracts the file on the desktop computer. These products are thus vulnerable when installed on a scan server.
Severity: 2/4.
|
|
Vulnerability : Trend Micro 2
InterScan Web Security Suite and InterScan Messaging Security quarantine the file by default. These products are vulnerable if the administrator changed the default configuration.
Severity: 2/4.
|
|
Vulnerability : Trend Micro 3
ScanMail does not indicate that the unscanned archive potentially contains a virus. This product is vulnerable in its default configuration.
Severity: 2/4.
|
|
Computer vulnerabilities tracking service
Vigil@nce provides a software vulnerability bulletin. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. Each administrator can customize the list of products for which he wants to receive vulnerability alerts.
|
