CVE-2005-0218
CVSS5.0
发布时间 :2005-05-02 00:00:00
修订时间 :2008-09-10 15:35:07
NMCOS    

[原文]ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.


[CNNVD]Base64编码图像失败漏洞(CNNVD-200505-801)

        ClamAV 0.80及更早版本使得远程攻击者可以通过在一个data: (RFC 2397) URL内的base64编码图像来绕过病毒扫描。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:clam_anti-virus:clamav:0.80
cpe:/a:clam_anti-virus:clamav:0.65
cpe:/a:clam_anti-virus:clamav:0.54
cpe:/a:clam_anti-virus:clamav:0.68
cpe:/a:clam_anti-virus:clamav:0.67
cpe:/a:clam_anti-virus:clamav:0.53
cpe:/a:clam_anti-virus:clamav:0.52
cpe:/a:clam_anti-virus:clamav:0.51
cpe:/a:clam_anti-virus:clamav:0.68.1
cpe:/a:clam_anti-virus:clamav:0.60

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0218
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0218
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200505-801
(官方数据源) CNNVD

- 其它链接及资源

http://www.gentoo.org/security/en/glsa/glsa-200501-46.xml
(PATCH)  GENTOO  GLSA-200501-46
http://sourceforge.net/project/shownotes.php?release_id=300116
(UNKNOWN)  CONFIRM  http://sourceforge.net/project/shownotes.php?release_id=300116
http://secunia.com/advisories/13900/
(VENDOR_ADVISORY)  SECUNIA  13900
http://www.mandriva.com/security/advisories?name=MDKSA-2005:025
(UNKNOWN)  MANDRAKE  MDKSA-2005:025

- 漏洞信息

Base64编码图像失败漏洞
中危 其他
2005-05-02 00:00:00 2005-10-20 00:00:00
远程  
        ClamAV 0.80及更早版本使得远程攻击者可以通过在一个data: (RFC 2397) URL内的base64编码图像来绕过病毒扫描。

- 公告与补丁

        暂无数据

- 漏洞信息

13045
Multiple ProductsRFC2397 Encoded Image Scan Bypass

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-01-10 Unknow
2005-01-10 Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
Failure to Handle Exceptional Conditions 12269
Yes No
2005-01-14 12:00:00 2009-07-12 09:27:00
Discovery of this weakness is credited to Darren Bounds <lists intrusense com>.

- 受影响的程序版本

Trend Micro WebProtect 3.1
Trend Micro InterScan Messaging Security Suite 5.5
Trend Micro InterScan Messaging Security Suite 3.81
TippingPoint Unity-One with Digital Vacine 2.0.0.2070
McAfee Webshield 3000 4.3.20
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
IronPort IronPort with Sophos AV Engine 3.88
Internet Security Systems SiteProtector 2.0 SP3
Internet Security Systems SiteProtector 2.0.4.561
Gentoo Linux
Clam Anti-Virus ClamAV 0.81
+ Gentoo Linux
Clam Anti-Virus ClamAV 0.80 rc4
Clam Anti-Virus ClamAV 0.80 rc3
Clam Anti-Virus ClamAV 0.80 rc2
Clam Anti-Virus ClamAV 0.80 rc1
Clam Anti-Virus ClamAV 0.80
Clam Anti-Virus ClamAV 0.70
Clam Anti-Virus ClamAV 0.68 -1
Clam Anti-Virus ClamAV 0.68
Clam Anti-Virus ClamAV 0.67
+ Gentoo Linux 1.4 _rc3
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.4
Clam Anti-Virus ClamAV 0.65
Clam Anti-Virus ClamAV 0.60
Clam Anti-Virus ClamAV 0.54
Clam Anti-Virus ClamAV 0.53
Clam Anti-Virus ClamAV 0.52
Clam Anti-Virus ClamAV 0.51
Check Point Software FireWall-1 R55 HFA08 with SmartDefense
ALT Linux ALT Linux Junior 2.3
ALT Linux ALT Linux Compact 2.3
TippingPoint Unity-One with Digital Vacine 2.0.0.2121

- 不受影响的程序版本

TippingPoint Unity-One with Digital Vacine 2.0.0.2121

- 漏洞讨论

Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs.

A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness.

This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.

- 漏洞利用

No exploit is required.

- 解决方案

It is reported that Trend Micro has released an update to address this vulnerability in affected Trend Micro products. This is not confirmed. Customers are advised to contact the vendor for further details regarding obtaining and applying an appropriate update.

TippingPoint has released Digital Vaccine 2.0.0.2121 to deal with this issue. Users of the affected software are advised to navigate to https://tmc.tippingpoint.com/TMC to acquire the relevant updates.

Gentoo linux has made advisory GLSA 200501-46 dealing with this issue. Gentoo advises that all ClamAV users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.81"

Mandrake has released advisory MDKSA-2005:025 to address this issue in ClamAV on Mandrake platforms. Please see the referenced advisory for more information.

ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站