[41214] in bugtraq
Re: [xfocus-AD-051115]Multiple antivirus failed to scan malicous filename bypass vulnerability
daemon@ATHENA.MIT.EDU (Thierry Zoller)
Tue Nov 15 18:44:20 2005
Date: Tue, 15 Nov 2005 21:23:21 +0100
From: Thierry Zoller <Thierry@Zoller.lu>
Reply-To: Thierry Zoller <Thierry@Zoller.lu>
Message-ID: <737301226.20051115212321@Zoller.lu>
To: "alert7@xfocus.org" <alert7@xfocus.org>
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com,
<vulnwatch@vulnwatch.org>
In-Reply-To: <43797949.6020703@xfocus.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=gb2312
Content-Transfer-Encoding: 8bit
Dear Alert7 ,
That means that if the user clicks on it using explorer.exe or
iexplorer.exe the file won't be executed because even Microsoft
Windows explorer is unable to parse the file?
axo> Demonstration here:
axo> Choose a malicious file which would be detected, such as nc.exe,
axo> rename the file as nc??.exe (?? =Hex C0 D7 BA DC)
axo> Because these special names are unable directly to input, so if you
axo> want to run these file, you should use the following way:
axo> Uses the MS-DOS name specification, we can operate file with OpenĦ˘
axo> ReadĦ˘WriteĦ˘ and duplicateĦ£
--
http://secdev.zoller.lu
Thierry Zoller
