You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2006/12/07 16:01:29 UTC
[Bug 5225] New: non-standard base64 encoding evades some scanners
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5225
Summary: non-standard base64 encoding evades some scanners
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P5
Component: Libraries
AssignedTo: dev@spamassassin.apache.org
ReportedBy: jm@jmason.org
SA -- at least 3.2.0 trunk -- isn't actually vulnerable to this; I'm just
using bugzilla as a convenient way to store details! ;)
http://www.quantenblog.net/security/virus-scanner-bypass
'Base64 encoding for MIME is defined in RFC 2045, which lists such an alphabet
and clearly states: All line breaks or other characters not found in [the
alphabet] must be ignored by decoding software. So it shouldn't make any
difference if we insert some random characters not in the alphabet into a Base64
encoded version of our good old EICAR string, right? Wrong. Some virus scanners
will happily pass viruses once they come in an unusual but still RFC-compliant
encoding. This is even more astonishing given such attacks have already been
discussed before.
Things start to get really nasty if some levels of multipart/mixed content are
wrapped around the harmful attachment. Then, only one of the six tested virus
scanners was able to detect the EICAR file. A simple perl script is provided as
a proof of concept. You may have to play with the $loop variable, which controls
the number of multipart nestings, depending on your virus scanner and mail
server. Note that your mail client may not be able to properly decode the
attachment as well (e.g. Gnus doesn't, but Mutt or Outlook will do the job).'
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5225] non-standard base64 encoding evades some scanners
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5225
------- Additional Comments From jm@jmason.org 2006-12-07 07:03 -------
Created an attachment (id=3768)
--> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3768&action=view)
test rule to catch the EICAR string, used to test this
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5225] non-standard base64 encoding evades some scanners
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5225
jm@jmason.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |WORKSFORME
Target Milestone|Undefined |3.2.0
------- Additional Comments From jm@jmason.org 2006-12-07 07:01 -------
as noted, SA is not vulnerable
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5225] non-standard base64 encoding evades some scanners
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5225
------- Additional Comments From jm@jmason.org 2006-12-07 07:04 -------
Created an attachment (id=3769)
--> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3769&action=view)
output sample using $loop = 1
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5225] non-standard base64 encoding evades some scanners
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5225
------- Additional Comments From jm@jmason.org 2006-12-07 07:03 -------
Created an attachment (id=3767)
--> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3767&action=view)
modified version of the "virus" generator script
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5225] non-standard base64 encoding evades some scanners
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5225
------- Additional Comments From jm@jmason.org 2006-12-07 07:06 -------
Created an attachment (id=3770)
--> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3770&action=view)
output sample using $loop = 5
install 88_eicar.cf in a rules dir, and run "spamassassin -Lt <
sample-loop1.txt", you'll get:
Content analysis details: (2.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 MISSING_DATE Missing Date: header
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
1.0 EICAR BODY: EICAR
1.0 TVD_SPACE_RATIO BODY: TVD_SPACE_RATIO
0.0 MIME_BASE64_BLANKS RAW: Extra blank lines in base64 encoding
-0.0 NO_RECEIVED Informational: message has no Received headers
no problem hitting the EICAR rule, in other words.
note that the modified virus.pl script has two changes: 1. the content type for
the mangled base64 part is changed to text/plain, as SA ignores application/*
content-type attachments; 2. the message is printed to stdout, rather than
delivered via Net::SMTP.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.