Archive Formats Kill Antivirus Products

nemiloc sends us to the F-Secure blog for breaking news about widespread vulnerabilities in programs that process archive files: "The Secure Programming Group at Oulu University has created a collection of malformed archive files. These archive files break and crash products from at least 40 vendors — including several antivirus vendors... including us." Here is test material from OUSPG and a joint advisory from Finnish and English security organizations. It isn't news that security products can have have security vulnerabilities. What makes this advisory important is that antivirus software is a perfect target. It is run in critical places with high privileges and auto-updates to keep versions coherent.

Comments

That's nothing

[Anonymous Coward]

Windows can crash over 9000 products.

Re:Secure Platform without Anti-virus

[JeanBaptiste]

Cool. I need to run MS SQL server, it's the only one that my company's workflow software will run on. Also our enterprise app is all written in ASP. We also have lots of Exchange users. It would probably take years and years to convert all these things over to something else, probably with downtime and data loss.

Your 'solution' may work for some, but probably not for most, and for the rest of us, thats what these articles are posted for!

Re:Secure Platform without Anti-virus

[TheRaven64]

That's okay, the money has already been allocated, because you factored in the cost of migrating away from the platform as part of the TCO. You did include migration costs in your TCO calculations when purchasing the workflow software and Exchange, right?

There's breakage and there's breakage

[davidwr]

There's

1. "I had an exception processing file ABC.ZIP, skipping file,"
2. Crashing and dying without handling the exception, and
3. Being exploited due to an unexpected condition.

The first lets viruses hide in carefully-mis-crafted archives.
The second lets viruses deactivate antivirus software.
The third lets viruses 0wn j00.

Some AV software is smart enough to log instances of #1.

Re:There's breakage and there's breakage

[mea37]

Really smart AV software wouldn't make assumptions about the contents of the file (eliminating #3), would always check for exceptions (eliminating #2), and would treat a processing exception pretty much like a virus (neutralizing #1).

Very little software in practice is that smart. But with AV, you know you're at war with the file you're scanning. Any AV vendor caught by this should be embarrased.

Hrm

[Shadow-isoHunt]

Details on the latest examples
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0308
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0309