发布时间 :2005-05-02 00:00:00
修订时间 :2008-09-10 15:35:07

[原文]ClamAV 0.80 and earlier allows remote attackers to bypass virus scanning via a base64 encoded image in a data: (RFC 2397) URL.


        ClamAV 0.80及更早版本使得远程攻击者可以通过在一个data: (RFC 2397) URL内的base64编码图像来绕过病毒扫描。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(PATCH)  GENTOO  GLSA-200501-46

- 漏洞信息

中危 其他
2005-05-02 00:00:00 2005-10-20 00:00:00
        ClamAV 0.80及更早版本使得远程攻击者可以通过在一个data: (RFC 2397) URL内的base64编码图像来绕过病毒扫描。

- 公告与补丁


- 漏洞信息

Multiple ProductsRFC2397 Encoded Image Scan Bypass

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-01-10 Unknow
2005-01-10 Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Multiple Vendor Anti-Virus Gateway Failure To Decode Base64 Encoded Image Weakness
Failure to Handle Exceptional Conditions 12269
Yes No
2005-01-14 12:00:00 2009-07-12 09:27:00
Discovery of this weakness is credited to Darren Bounds <lists intrusense com>.

- 受影响的程序版本

Trend Micro WebProtect 3.1
Trend Micro InterScan Messaging Security Suite 5.5
Trend Micro InterScan Messaging Security Suite 3.81
TippingPoint Unity-One with Digital Vacine
McAfee Webshield 3000 4.3.20
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
IronPort IronPort with Sophos AV Engine 3.88
Internet Security Systems SiteProtector 2.0 SP3
Internet Security Systems SiteProtector
Gentoo Linux
Clam Anti-Virus ClamAV 0.81
+ Gentoo Linux
Clam Anti-Virus ClamAV 0.80 rc4
Clam Anti-Virus ClamAV 0.80 rc3
Clam Anti-Virus ClamAV 0.80 rc2
Clam Anti-Virus ClamAV 0.80 rc1
Clam Anti-Virus ClamAV 0.80
Clam Anti-Virus ClamAV 0.70
Clam Anti-Virus ClamAV 0.68 -1
Clam Anti-Virus ClamAV 0.68
Clam Anti-Virus ClamAV 0.67
+ Gentoo Linux 1.4 _rc3
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.4
Clam Anti-Virus ClamAV 0.65
Clam Anti-Virus ClamAV 0.60
Clam Anti-Virus ClamAV 0.54
Clam Anti-Virus ClamAV 0.53
Clam Anti-Virus ClamAV 0.52
Clam Anti-Virus ClamAV 0.51
Check Point Software FireWall-1 R55 HFA08 with SmartDefense
ALT Linux ALT Linux Junior 2.3
ALT Linux ALT Linux Compact 2.3
TippingPoint Unity-One with Digital Vacine

- 不受影响的程序版本

TippingPoint Unity-One with Digital Vacine

- 漏洞讨论

Multiple vendor anti-virus gateway products are reported prone to a security weakness that could lead to a false sense of security. It is reported that the affected anti-virus gateways do not decode base64-encoded images that are contained in 'data' URIs.

A malicious image that is obfuscated in this manner will bypass the affected anti-virus scanner; the image will be rendered in the browser of a target user when the malicious page is viewed. It is reported that because Microsoft Internet Explorer does not support the 'data' URI, Internet Explorer cannot be used as an attack vector to exploit this weakness.

This weakness may lead to a false sense of security where a network administrator believes that the affected product will detect malicious images designed to trigger a target vulnerability. In reality, the images may be obfuscated by an attacker and may not be detected.

- 漏洞利用

No exploit is required.

- 解决方案

It is reported that Trend Micro has released an update to address this vulnerability in affected Trend Micro products. This is not confirmed. Customers are advised to contact the vendor for further details regarding obtaining and applying an appropriate update.

TippingPoint has released Digital Vaccine to deal with this issue. Users of the affected software are advised to navigate to to acquire the relevant updates.

Gentoo linux has made advisory GLSA 200501-46 dealing with this issue. Gentoo advises that all ClamAV users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.81"

Mandrake has released advisory MDKSA-2005:025 to address this issue in ClamAV on Mandrake platforms. Please see the referenced advisory for more information.

ALT Linux has released updates dealing with this and other issues. Please see the reference section for more information.

- 相关参考