[TZO-07-2009] F-PROT ZIP Method evasion

[Thierry Zoller <Thierry@xxxxxxxxx>]

______________________________________________________________________

  From the low-hanging-fruit-department - F-PROT ZIP method evasion 
______________________________________________________________________

Release mode: Coordinated.
Ref         : TZO-07-2009 Fprot ZIP Method Evasion
WWW         : http://blog.zoller.lu/
Vendor      : http://www.f-prot.com
Security notification reaction rating : Mediocre-Poor
Disclosure Policy : 
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

This bug was reported 4 years ago [1] to FRISK, the response at that
time has been that "a fix for this bug will be included in future 
versions of F-Prot Antivirus". Fast forward 4 years the same error 
still allow to bypass the engine.

[1] CVE-2005-3499 
http://www.zoller.lu/research/fprot.htm
http://web.nvd.nist.gov/view/vuln/detail?execution=e3s1

Considering this and the reaction from FRISK I am unsure as how 
serious FRISK is about the security of their clients.

Affected products : 
- All Fprot versions currently used, vendor supplies no patch for 
  current release. The vendor (Frisk) considers this problem to be 
  too low priority to patch in current release and notify clients. 
  To put this in perspective, rendering the Fprot scanning on GW 
  solutions completely useless (for certain archive types)
  is low priority for Frisk. 
  
  If you are a Frisk customer and concerned about security I would
  recommend calling support and ask for a patch. NB, if you are using
  FPROT localy and with ON access scans you are not affected.
  
Products (with impact details) :
- F-PROT AVES (High: complete bypass of engine)
- F-PROT Antivirus for Windows (unknown)
- F-PROT Antivirus for Windows on Mail Servers : (High: complete 
bypass of engine) 
- F-PROT Antivirus for Exchange (High: complete bypass of engine)
- F-PROT Antivirus for Linux x86 Mail Servers : (High: complete bypass
  of engine)
- F-PROT Antivirus for Linux x86 File Servers : (High: complete bypass
  of engine)
- F-PROT Antivirus for Solaris SPARC / Solaris x86 Mail Servers
(High: complete bypass of engine)
- F-PROT Milter - for example sendmail (High: complete bypass of engine)
- F-PROT Antivirus for Linux on IBM zSeries (S/390) (High: complete 
  bypass of engine)
- F-Prot Antivirus for Linux x86 Workstations (unknown)

About this advisory
-------------------
I used to not report bugs publicly where a a vendor - has not reacted 
to my notifications - silently patched. I also did not publish
low hanging fruits as they make you look silly in the eyes of your
peers.

Over the past years I had the chance to audit and test a lot of critical 
infrastructures that (also) relied on products (and about security 
notification from vendors) and have witnessed various ways of setting 
up your defenses that make some bugs critical that you'd consider low, 
I came to the conclusion that most bugs deserve disclosure. 

Please see "Common misconceptions" for more information.

I. Background
~~~~~~~~~~~~~
FRISK Software International, established in 1993, is one of the 
world's leading companies in antivirus research and product 
development.
FRISK Software produces the hugely popular F-Prot Antivirus products 
range offering unrivalled heuristic detection capabilities. 
In addition to this, the F-Prot AVES managed online email security 
service filters away the nuisance of spam email as well as viruses, 
worms and other malware that increasingly clog up inboxes and 
threaten data security. 

II. Description
~~~~~~~~~~~~~~~
The parsing engine can be bypassed by manipulating ZIP Method field. 
It is as easy as opening a ZIP file in an editor and type a number 
greater than 15 on your keyboard. Basically Fprot looks at the Method 
field that indicates what method was used to compress the archive 
and decides that it will not extract and inspect the data within.

III. Impact
~~~~~~~~~~~
The bug results in denying the engine the possibility to inspect
code within the ZIP archive. While the impact might be low client-
side (as code is inspected upon extraction by the user) the impact
for gateways or AV infrastructure where the archive is not extracted 
is considerable. There is no inspection of the content at all, prior 
disclosure therefore refered to this class of bugs as Denial of service 
(you deny the service of the scan engine for that file) however I 
choose to stick the terms of evasion/bypass, being the primary impact 
of these types of bugs.

PS. I am aware that there are hundreds of ways to bypass, that however
doesn't make it less of a problem. I am waiting for the day where the 
first worm uses these techniques to stay undetected over a longer 
period of time, as depending on the evasion a kernel update (engine 
update) is necessary and sig updates do not suffice. Resulting in 
longer window of exposure - at least for GW solutions. *Must make 
confiker reference here*


IV. Common misconceptions about this "bug class"
--------------------------------------------------
- This has the same effect as adding a password to a archive file

The scanner explicitely denotes files that are passworded, an example 
is an Gateway scanner that adds "Attachment not scanned" to the 
subject line or otherwise indicates that the file was not scanned. 
This is not the case with bypasses, in most cases the engine has not 
inspected the content at all or has inspected it in a different way.
Additional passworded archive files are easily filterable by a content
policy, allowing or denying them.

- This is only an issue with gateway products

Every environment where the archive is not actively extracted by 
the end-user is affected. For example, fileservers, databases
etc. pp. Over the years I saw the strangest environments that 
were affected by this type of "bug". My position is that customers
deserve better security than this.

- If this is exploited by a worm it will be fixed within minutes.
Some bypasses required modifications in the AV "kernel" and cannot be
fixed with a signature update. As such it would not only take longer
but for those customers that do no push binary updates immediately 
(or not at all) increase the window of exposure consistently.

- Behavioral analysis will catch this ?
No, the content is unreadable to the AV engine as such no inspection
whatsoever is possible.

- Evasions are the Cross Site scripting of File formats bugs
Yes.


IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~

23/03/2009 : Send proof of concept, description the terms under which 
             I cooperate and the planned disclosure date (02/04/2009)
                         
26/03/2009 : Technical Support responds 
             "The fix for this was minor, with virtually no potential 
             for side effects - so it was added to the current 
             development branch for engine version 4.5 - being 
             low-priority, it will not be added to the 4.4 branch.

             In other words, the fix will be included in the next 
             engine released."

26/03/2009 : Replied, that
             - the bug is 4 years old
             - risk assesement is to be done by the client using 
             the engine one way or the other
             - asked for location of advisory or credit
             
             No reply.
             
27/03/2009 : Resend.         
             
             No reply.             
            
No further coordination attempts will be done with FRISK should they not 
revisit there position on security notification and response practices.