• Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Home
  • About Darknet
  • Hacking Tools
  • Popular Posts
  • Darknet Archives
  • Contact Darknet
    • Advertise
    • Submit a Tool
Darknet – Hacking Tools, Hacker News & Cyber Security

Darknet - Hacking Tools, Hacker News & Cyber Security

Darknet is your best source for the latest hacking tools, hacker news, cyber security best practices, ethical hacking & pen-testing.

Multiple Bugs In Anti-Virus Software Revealed

April 16, 2009

Views: 6,207

[ad]

A spate of bugs have popped up recently in quite a few of the major anti-virus brands, some are old bugs which have just been made public and some are apparently new bugs – just discovered. Nothing too serious it seems (no remote takeover vulnerabilities) mostly just crashes and annoyances.

Included are Symantec’s Norton Anti-virus, Kaspersky Anti-Virus 6.0, F-Prot, IBM Proventia and Clam Antivirus.

Once an occasional inconvenience, serious security bugs and vulnerabilities in anti-virus and security suite products are growing into hardy perennials. Once, running Windows anti-virus was like driving down a dual carriageway. These days, it’s more like an unpaved road.

Last week alone bought a confirmed snag with anti-virus products from Kaspersky Lab and a reported oddity with an update Norton anti-virus from Symantec. Elsewhere an allegedly long running flaw in anti-virus scanner from F-Prot was published for the first time. The Kaspersky bug had the potential to result in serious annoyance. The other bugs are less serious and individually don’t amount to much, but collectively, they’re enough to make you reach for an Ubuntu installation CD or start looking on eBay for a Mac.

First up, let’s consider a misfiring definition update for Kaspersky Anti-Virus 6.0 for Windows Workstations, which sent users into pop-up hell. It was issued on 31 March, and it wasn’t resolved until 2 April.

The worst one in my opinion is the Kaspersky problem, because it’s their own fault? How can a company with so many users, pushing out automatic updates have such poor quality control?

Pushing out an update that messes up a users machine and not fixing it for 3 days is enough to stop using a product for me.

Elsewhere reports on Norton’s support forums on Saturday (4 April) suggest a Symantec update killed right click menu on PCs running Windows Vista. We brought the thread to Symantec’s attention earlier this afternoon and wait the security giant response to the odd, not to say bizarre, reported glitch with interest.

Moving on past glitches there’s also straightforward security vulnerabilities to consider. A flaw in F-Prot involving the scanning of Zip files allegedly creates a possible method to circumvent anti-virus protection. Security researcher Thierry Zoller, who discovered the vulnerability, went public with the flaw on 2 April after F-Prot failed to act for a reported four years.

Zoller also published two other advisories last week, each covering problems with enterprise products and scanning archived files. Malicious RAR archives might make their way past IBM Proventia email security appliances, according to Zoller. He published a limited details advisory after not hearing from IBM for a month. IBM is reportedly investigating the issue.

Clam AntiVirus, the open source anti-virus toolkit for UNIX, which is used to scan email on mail gateways for Windows viruses, also had a problem with RAR files. That problem was plugged late last month but only publicised by Zoller with an advisory last week.

Even the popular Linux/UNIX solution Clam Antivirus didn’t escape testing throwing up a bug when scanning RAR files. I’m surprised AV still has such problems with RAR/Zip and compressed files.

We worked out long ago if you made a batch script to make an almost infinite loop of zip files (zip within zip within zip etc) you could bomb out the CPU totally on most AV e-mail gateways.

I hope 10 years later they aren’t still having the same problems.

Source: The Register

Share
Tweet
Share
Buffer
WhatsApp
Email
0 Shares

Filed Under: Countermeasures, Exploits/Vulnerabilities, Security Software Tagged With: antivirus, kaspersky, symantec



Reader Interactions

Comments

  1. nubanx says

    April 16, 2009 at 8:12 pm

    Its the nature of the beast.
    As of this year, the tipping point between white listed software and blacklisted software will tilt towards black listed for the first time (ever). This means that there is now actually more malicious software created than “””good””” software.
    More and more companies will begin working from the whitelisted software models.

    The complexity of the AV solutions out there have had no choice but to play catch up, and move towards signature based attacks and other heuristic based protection. Throw this elevated complexity into the ever increasing complexity of the windows environment, and.. well.. you have today.

    Antivirus updates don’t just always mean adding defs to the database for the local client. It could be engine updates and other components as well. Pushing these types of updates to the world of windows machines (running version X with software Y on hardware Z)is an extremely complex mechanism. Updates do “odd” things all the time from a corporate standpoint. Most corporations invest in the support services from the AV vendor. Home users? well.. some pay for the support, others probably don’t even need it. (MAC and GNU/Linux users don’t require much in this arena, and they are gaining market share into home computing use.

    also – currently most AV products (depending on how its configured, of course) do not experience the old recursive zip bomb, and limit their nested file scanning limit to ~9 deep.
    and… everytime i read bomb, i dont know why but i always think of :(){ :|:& };:

    :-P

    please keep up the good work you do with this site.
    i enjoy it.

    -nubanx

  2. Darknet says

    April 17, 2009 at 7:55 am

    Thanks for your interesting and well thought out comment, I agree with what you say – it is a complex area. But still they should try and control the updates as best they can.

    It’s not easy sending out updates for multiple OS versions/architectures/update levels.

    Thanks for the compliment, keep reading and keep commenting and I’ll keep publishing :)

Primary Sidebar

Search Darknet

  • Email
  • Facebook
  • LinkedIn
  • RSS
  • Twitter

Advertise on Darknet

Latest Posts

Falco - Real-Time Threat Detection for Linux and Containers

Falco – Real-Time Threat Detection for Linux and Containers

Views: 292

Security visibility inside containers, Kubernetes, and cloud workloads remains among the hardest … ...More about Falco – Real-Time Threat Detection for Linux and Containers

Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

Views: 587

As threat surfaces grow and attack sophistication increases, many security teams face the same … ...More about Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

Views: 555

With more businesses running Linux in production—whether in bare metal, VMs, or containers—the need … ...More about Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

SUDO_KILLER - Auditing Sudo Configurations for Privilege Escalation Paths

SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Views: 589

sudo is a powerful utility in Unix-like systems that allows permitted users to execute commands with … ...More about SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Bantam - Advanced PHP Backdoor Management Tool For Post Exploitation

Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

Views: 449

Bantam is a lightweight post-exploitation utility written in C# that includes advanced payload … ...More about Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

AI-Powered Cybercrime in 2025 - The Dark Web’s New Arms Race

AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Views: 675

In 2025, the dark web isn't just a marketplace for illicit goods—it's a development lab. … ...More about AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Topics

  • Advertorial (28)
  • Apple (46)
  • Countermeasures (228)
  • Cryptography (82)
  • Database Hacking (89)
  • Events/Cons (7)
  • Exploits/Vulnerabilities (431)
  • Forensics (65)
  • GenAI (3)
  • Hacker Culture (8)
  • Hacking News (229)
  • Hacking Tools (684)
  • Hardware Hacking (82)
  • Legal Issues (179)
  • Linux Hacking (74)
  • Malware (238)
  • Networking Hacking Tools (352)
  • Password Cracking Tools (104)
  • Phishing (41)
  • Privacy (219)
  • Secure Coding (118)
  • Security Software (235)
  • Site News (51)
    • Authors (6)
  • Social Engineering (37)
  • Spammers & Scammers (76)
  • Stupid E-mails (6)
  • Telecomms Hacking (6)
  • UNIX Hacking (6)
  • Virology (6)
  • Web Hacking (384)
  • Windows Hacking (169)
  • Wireless Hacking (45)

Security Blogs

  • Dancho Danchev
  • F-Secure Weblog
  • Google Online Security
  • Graham Cluley
  • Internet Storm Center
  • Krebs on Security
  • Schneier on Security
  • TaoSecurity
  • Troy Hunt

Security Links

  • Exploits Database
  • Linux Security
  • Register – Security
  • SANS
  • Sec Lists
  • US CERT

Footer

Most Viewed Posts

  • Brutus Password Cracker – Download brutus-aet2.zip AET2 (2,297,472)
  • Darknet – Hacking Tools, Hacker News & Cyber Security (2,173,102)
  • Top 15 Security Utilities & Download Hacking Tools (2,096,637)
  • 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) (1,199,691)
  • Password List Download Best Word List – Most Common Passwords (933,520)
  • wwwhack 1.9 – wwwhack19.zip Web Hacking Software Free Download (776,168)
  • Hack Tools/Exploits (673,297)
  • Wep0ff – Wireless WEP Key Cracker Tool (530,182)

Search

Recent Posts

  • Falco – Real-Time Threat Detection for Linux and Containers May 19, 2025
  • Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance May 16, 2025
  • Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked) May 14, 2025
  • SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths May 12, 2025
  • Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation May 9, 2025
  • AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race May 7, 2025

Tags

apple botnets computer-security darknet Database Hacking ddos dos exploits fuzzing google hacking-networks hacking-websites hacking-windows hacking tool Information-Security information gathering Legal Issues malware microsoft network-security Network Hacking Password Cracking pen-testing penetration-testing Phishing Privacy Python scammers Security Security Software spam spammers sql-injection trojan trojans virus viruses vulnerabilities web-application-security web-security windows windows-security Windows Hacking worms XSS

Copyright © 1999–2025 Darknet All Rights Reserved · Privacy Policy