[TZO-05-2009] Clamav 0.94 and below - Evasion /bypass

[Thierry Zoller <Thierry@xxxxxxxxx>]

______________________________________________________________________

  From the low-hanging-fruit-department - Generic ClamAV evasion 
______________________________________________________________________

Release mode: Coordinated but limited disclosure.
Ref         : TZO-062009- ClamAV Evasion
WWW         : 
http://blog.zoller.lu/2009/04/clamav-094-and-below-evasion-and-bypass.html
Vendor      : http://www.clamav.net &
              http://www.sourcefire.com/products/clamav
Security notification reaction rating : Good.
Disclosure Policy : 
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

Affected products : 
- ClamAV below 0.95
  Includes MACOSX server,IBM Secure E-mail Express Solution for System
  and a lots of mail appliances.
  http://www.clamav.net/about/who-use-clamav/

About this advisory
-------------------
I used to not report bugs publicly where a a vendor - has not reacted 
to my notifications - silently patched. I also did not publish
low hanging fruits as they make you look silly in the eyes of your
peers.

Over the past years I had the chance to audit and test a lot of critical 
infrastructures that, amongst other things relied on security products 
(and on security notifications from vendors) and have witnessed various 
ways of setting up your defenses that make some bugs critical that 
you'd consider low at first glance, I came to the conclusion that most
bugs deserve disclosure. 

Please see "Common misconceptions" for more information.

I. Background
~~~~~~~~~~~~~
Clam AntiVirus is an open source (GPL) anti-virus toolkit for UNIX, 
designed especially for e-mail scanning on mail gateways. It provides 
a number of utilities including a flexible and scalable multi-threaded
daemon, a command line scanner and advanced tool for automatic 
database updates. The core of the package is an anti-virus engine 
available in a form of shared library. 

II. Description
~~~~~~~~~~~~~~~
The parsing engine can be bypassed by manipulating RAR archive in 
a "certain way" that the Clamav engine cannot extract the content but
the end user is able to. Details are currently witheld (thanks to IBM).

III. Impact
~~~~~~~~~~~
The bug results in denying the engine the possibility to inspect
code within the RAR archive. While the impact might be low client-
side (as code is inspected upon extraction by the user) the impact
for gateways or AV infrastructure where the archive is not extracted 
is considerable. There is no inspection of the content at all, prior 
disclosure therefore referred to this class of bugs as Denial of service 
(you deny the service of the scan engine for that file) however I 
choose to stick the terms of evasion/bypass, being the primary impact 
of these types of bugs.

PS. I am aware that there are hundreds of ways to bypass, that however
doesn't make it less of a problem. I am waiting for the day where the 
first worm uses these techniques to stay undetected over a longer 
period of time, as depending on the evasion a kernel update (engine 
update) is necessary and sig updates do not suffice. Resulting in 
longer window of exposure - at least for GW solutions. *Must make 
confiker reference here*


IV. Common misconceptions about this "bug class"
--------------------------------------------------
- This has the same effect as adding a password to a ZIP file

The scanner denotes files that are passworded, an example is an E-mail
GW scanner that adds "Attachment not scanned" to the subject line or
otherwise indicates that the file was not scanned. This is not the case
with bypasses, in most cases the engine has not inspected the content
at all or has inspected it in a different way.
Additionally passworded archive files are easily filterable by a content
policy, allowing or denying them.

- This is only an issue with gateway products

Every environment where the archive is not actively extracted by 
the end-user is affected. For example, fileservers, databases
etc. pp. Over the years I saw the strangest environments that 
were affected by this type of "bug". My position is that customers
deserve better security than this.

- Behavioral analysis will catch this ?
No, the content is unreadable to the AV engine as such no inspection
whatsoever is possible.

- Evasions are the Cross Site scripting of File formats bugs
Yes.


IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~

IBM was sent two POC files, an explanation and the disclosure terms 
(http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html)

09/03/2009 : Send proof of concept, description the terms under which 
             I cooperate and the planned disclosure date (23/03/2009)
                         
13/03/2009 : Clamav responds that the bug is reproducible and will be
             fixed in 0.95 to be released the 23/03/2009
             
             (IBM take note, it's that easy.)

23/05/2009 : Asked clamav if the release was made and if credit was 
             given

23/05/2009 : Clamav responds that the release was made, and that the
             credit was given in the changelog. (Tzo note: A post will 
             be probably be made at http://www.clamav.net/category/security/
                                 
02/01/2009 : Release of this limited detail advisory

Final comments :
I would like to thank Tomasz Kojm (clamav) for the professional 
reaction and AV-Test GMBH for their support.