Another Anti-Virus Problem
Here's more evidence if you need to make a case that blindly requiring anti-virus or other agents on all systems is neither cost-free nor automatically justified, as I mentioned late last year. As reported by SANS @RISK (link will work shortly):
Trend Micro Antivirus, a popular antivirus solution, contains a buffer overflow vulnerability when parsing executables compressed with the UPX executable compression program. A specially-crafted executable could trigger this buffer overflow and execute arbitrary code with SYSTEM/root privileges, allowing complete control of the vulnerable system. Note that the malicious file can be sent to a vulnerable system via email (spam messages), web, FTP, Instant Messaging or Peer-to-Peer file sharing. UPX file format vulnerabilities have been widely-reported in the past, and UPX file fuzzers are commonly available.
Here's the Trend Micro advisory.
Trend Micro Antivirus, a popular antivirus solution, contains a buffer overflow vulnerability when parsing executables compressed with the UPX executable compression program. A specially-crafted executable could trigger this buffer overflow and execute arbitrary code with SYSTEM/root privileges, allowing complete control of the vulnerable system. Note that the malicious file can be sent to a vulnerable system via email (spam messages), web, FTP, Instant Messaging or Peer-to-Peer file sharing. UPX file format vulnerabilities have been widely-reported in the past, and UPX file fuzzers are commonly available.
Here's the Trend Micro advisory.
Comments
It's almost as if the virus writers (or at least the designer of UPX) knew that the AV writers were going to screw up something like a UPX parser and baited them into such a screw-up.
"Even" Windows Vista becomes instantly vulnerable if you install Windows Defender anti-spyware on it without the Feb. 14 update.
Microsoft Security Bulletin MS07-010, Affected Software:
Microsoft Windows Defender in Windows Vista
Windows Live OneCare
Microsoft Antigen for Exchange 9.x
Microsoft Antigen for SMTP Gateway 9.x
Microsoft Windows Defender
Microsoft Windows Defender x64 Edition
Microsoft Forefront Security for Exchange Server
Microsoft Forefront Security for SharePoint
Thanks Richard, for a most awesome website.
I never use typical AV scanners and recommend you also do not. They are fine for incident response, when you have the computer in an electronically-shielded room with no network connections.
In fact, I have BartPE on a bootable USB key with the portable version of NOD32. I use it to do this sort of "offline" scanning.