Monday, February 12, 2007

Another Anti-Virus Problem

Here's more evidence if you need to make a case that blindly requiring anti-virus or other agents on all systems is neither cost-free nor automatically justified, as I mentioned late last year. As reported by SANS @RISK (link will work shortly):

Trend Micro Antivirus, a popular antivirus solution, contains a buffer overflow vulnerability when parsing executables compressed with the UPX executable compression program. A specially-crafted executable could trigger this buffer overflow and execute arbitrary code with SYSTEM/root privileges, allowing complete control of the vulnerable system. Note that the malicious file can be sent to a vulnerable system via email (spam messages), web, FTP, Instant Messaging or Peer-to-Peer file sharing. UPX file format vulnerabilities have been widely-reported in the past, and UPX file fuzzers are commonly available.

Here's the Trend Micro advisory.

7 comments:

dre said...

UPX file format vulnerabilities have been widely-reported in the past, and UPX file fuzzers are commonly available

It's almost as if the virus writers (or at least the designer of UPX) knew that the AV writers were going to screw up something like a UPX parser and baited them into such a screw-up.

Chris Rohlf said...

I have blogged before on trusting analysis software. Not specifically AV but disassemblers/debuggers etc. They contain vulnerabilities as well and we are silly to think malware will not start targeting them explicitly.

Anonymous said...

Good point, although I am reflexively queasy about having a system without A/V installed.

"Even" Windows Vista becomes instantly vulnerable if you install Windows Defender anti-spyware on it without the Feb. 14 update.

Microsoft Security Bulletin MS07-010, Affected Software:

Microsoft Windows Defender in Windows Vista
Windows Live OneCare
Microsoft Antigen for Exchange 9.x
Microsoft Antigen for SMTP Gateway 9.x
Microsoft Windows Defender
Microsoft Windows Defender x64 Edition
Microsoft Forefront Security for Exchange Server
Microsoft Forefront Security for SharePoint

Thanks Richard, for a most awesome website.

dre said...

AV agents/scanners are crap. I currently use Blink for personal use when I have to. When I have to make an AV recommendation to an organization, it is usually BigFix.

I never use typical AV scanners and recommend you also do not. They are fine for incident response, when you have the computer in an electronically-shielded room with no network connections.

In fact, I have BartPE on a bootable USB key with the portable version of NOD32. I use it to do this sort of "offline" scanning.

Tinman said...

About 7 or 8 months ago I was working for a networking company that used Trend Micro Client/Server Suite on 95% of it's customers. We also used RealVNC to remotely "fix" issues that arrived over a VPN. Trend sent out an update that classified RealVNC as a trojan, but not one instance,but many thousand per machine and every customer at the same time freaked out. Subsequently Trend had to send a patch a few hours later , and we spent a few days reassuring everyone that the issue was resolved and that they weren't infected many thousand times over with the troj/generic 'virus'.

Carlos said...

thegreenvoid.blogspot.com

Free Virus Protection said...

Some have we solve problem but some are it has a bad effect.