Freely subscribe to our NEWSLETTER

SYNTHESIS OF THE VULNERABILITY

An attacker can create a CAB archive containing a virus which is
not detected by F-PROT.

Severity: 2/4

Consequences: data flow

Provenance: document

Means of attack: no proof of concept, no attack

Ability of attacker: expert (4/4)

Confidence: unique source (2/5)

Diffusion of the vulnerable configuration: high (3/3)

Creation date: 11/05/2009

IMPACTED PRODUCTS

– F-PROT Antivirus

DESCRIPTION OF THE VULNERABILITY

F-PROT products detect viruses contained in CAB archives.

However, an attacker can create a slightly malformed archive (by
changing "Filesize"), which can still be opened by Unzip tools,
but which cannot be opened by the antivirus.

An attacker can therefore create a CAB archive containing a virus
which is not detected by F-PROT.

CHARACTERISTICS

Identifiers: BID-34896, TZO-21-2009, VIGILANCE-VUL-8705

http://vigilance.fr/vulnerability/F-PROT-Antivirus-bypassing-via-CAB-8705