16 April 2009 | 6,013 views

Multiple Bugs In Anti-Virus Software Revealed

Prevent Network Security Leaks with Acunetix

A spate of bugs have popped up recently in quite a few of the major anti-virus brands, some are old bugs which have just been made public and some are apparently new bugs – just discovered. Nothing too serious it seems (no remote takeover vulnerabilities) mostly just crashes and annoyances.

Included are Symantec’s Norton Anti-virus, Kaspersky Anti-Virus 6.0, F-Prot, IBM Proventia and Clam Antivirus.

Once an occasional inconvenience, serious security bugs and vulnerabilities in anti-virus and security suite products are growing into hardy perennials. Once, running Windows anti-virus was like driving down a dual carriageway. These days, it’s more like an unpaved road.

Last week alone bought a confirmed snag with anti-virus products from Kaspersky Lab and a reported oddity with an update Norton anti-virus from Symantec. Elsewhere an allegedly long running flaw in anti-virus scanner from F-Prot was published for the first time. The Kaspersky bug had the potential to result in serious annoyance. The other bugs are less serious and individually don’t amount to much, but collectively, they’re enough to make you reach for an Ubuntu installation CD or start looking on eBay for a Mac.

First up, let’s consider a misfiring definition update for Kaspersky Anti-Virus 6.0 for Windows Workstations, which sent users into pop-up hell. It was issued on 31 March, and it wasn’t resolved until 2 April.

The worst one in my opinion is the Kaspersky problem, because it’s their own fault? How can a company with so many users, pushing out automatic updates have such poor quality control?

Pushing out an update that messes up a users machine and not fixing it for 3 days is enough to stop using a product for me.

Elsewhere reports on Norton’s support forums on Saturday (4 April) suggest a Symantec update killed right click menu on PCs running Windows Vista. We brought the thread to Symantec’s attention earlier this afternoon and wait the security giant response to the odd, not to say bizarre, reported glitch with interest.

Moving on past glitches there’s also straightforward security vulnerabilities to consider. A flaw in F-Prot involving the scanning of Zip files allegedly creates a possible method to circumvent anti-virus protection. Security researcher Thierry Zoller, who discovered the vulnerability, went public with the flaw on 2 April after F-Prot failed to act for a reported four years.

Zoller also published two other advisories last week, each covering problems with enterprise products and scanning archived files. Malicious RAR archives might make their way past IBM Proventia email security appliances, according to Zoller. He published a limited details advisory after not hearing from IBM for a month. IBM is reportedly investigating the issue.

Clam AntiVirus, the open source anti-virus toolkit for UNIX, which is used to scan email on mail gateways for Windows viruses, also had a problem with RAR files. That problem was plugged late last month but only publicised by Zoller with an advisory last week.

Even the popular Linux/UNIX solution Clam Antivirus didn’t escape testing throwing up a bug when scanning RAR files. I’m surprised AV still has such problems with RAR/Zip and compressed files.

We worked out long ago if you made a batch script to make an almost infinite loop of zip files (zip within zip within zip etc) you could bomb out the CPU totally on most AV e-mail gateways.

I hope 10 years later they aren’t still having the same problems.

Source: The Register



Recent in Countermeasures:
- Don’t Get Hacked – Have A Free Acunetix Security Scan
- Bro – Passive Open-Source Network Traffic Analyzer
- Hook Analyser 3.1 – Malware Analysis Tool

Related Posts:
- Microsoft’s Live OneCare the WORST Anti-Virus Solution
- Anti-Spyware Software Wars – Can’t they get along?!
- Custom Trojans – Isn’t it Old News?

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,052 views
- Password Hasher Firefox Extension - 116,940 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,543 views

Low-cost VPS Hosting

2 Responses to “Multiple Bugs In Anti-Virus Software Revealed”

  1. nubanx 16 April 2009 at 8:12 pm Permalink

    Its the nature of the beast.
    As of this year, the tipping point between white listed software and blacklisted software will tilt towards black listed for the first time (ever). This means that there is now actually more malicious software created than “””good””” software.
    More and more companies will begin working from the whitelisted software models.

    The complexity of the AV solutions out there have had no choice but to play catch up, and move towards signature based attacks and other heuristic based protection. Throw this elevated complexity into the ever increasing complexity of the windows environment, and.. well.. you have today.

    Antivirus updates don’t just always mean adding defs to the database for the local client. It could be engine updates and other components as well. Pushing these types of updates to the world of windows machines (running version X with software Y on hardware Z)is an extremely complex mechanism. Updates do “odd” things all the time from a corporate standpoint. Most corporations invest in the support services from the AV vendor. Home users? well.. some pay for the support, others probably don’t even need it. (MAC and GNU/Linux users don’t require much in this arena, and they are gaining market share into home computing use.

    also – currently most AV products (depending on how its configured, of course) do not experience the old recursive zip bomb, and limit their nested file scanning limit to ~9 deep.
    and… everytime i read bomb, i dont know why but i always think of :(){ :|:& };:

    :-P

    please keep up the good work you do with this site.
    i enjoy it.

    -nubanx

  2. Darknet 17 April 2009 at 7:55 am Permalink

    Thanks for your interesting and well thought out comment, I agree with what you say – it is a complex area. But still they should try and control the updates as best they can.

    It’s not easy sending out updates for multiple OS versions/architectures/update levels.

    Thanks for the compliment, keep reading and keep commenting and I’ll keep publishing :)