Forwarded for interest... -------- Forwarded Message -------- From: Trog <[EMAIL PROTECTED]> To: <snip> Subject: Re: [Full-Disclosure] Multi-vendor AV gateway image inspection bypass vulnerability Date: Fri, 14 Jan 2005 19:07:00 +0000 Quoting Darren Bounds <[EMAIL PROTECTED]>:
> Multi-vendor AV gateway image inspection bypass vulnerability > January 10, 2005 > > A vulnerability has been discovered which allows a remote attacker > to bypass anti-virus > (as well other security technologies such as IDS and IPS) inspection > of HTTP image content. > > By leveraging techniques described in RFC 2397 for base64 encoding > image content within > the URL scheme. A remote attack may encode a malicious image within > thebody of an HTML > formatted document to circumvent content inspection. Support for extracting RFC2397 encoded data within HTML documents has been added to the CVS version of Clam AntiVirus, the open source virus scanner. The next stable release containing this feature, version 0.81 is scheduled to become a Release Candidate on 19th Jan. Until that time, access to the current development code is available via CVS and nightly tarballs. See www.clamav.net for download details. Thanks, -trog _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
