Introduction :
Flaws in the way F-Secure software handles ZIP and RAR data compression archives could allow an attacker to execute remote code on users' systems and also to bypass F-Secure's antivirus-scanning capabilities.

Details :
I found mutliple vulnerabilities within various AV Engines, F-Secure are the first to actually publish a real advisory, others fixed the bugs silently or put a small notice in a change_log. I will however not publish more details about the findings as of yet, there are too many AV engines vulnerable to similar issues and I am going to wait until most of them have patched the flaws until I exactly dislclose my findings.
http://www.f-secure.com/security/fsc-2006-1.shtml

Rain Forest Puppy once defined a "Responsible Disclosure Practice", I adhere to it.

[Update]
The Story has been posted on SecurityFocus, News.com, Washington Post, Heise, Suedeutsche, ZDnet, Computerworld, and various others. Special Thanks to Mikko for giving me Credit.

Introduction :
"ZangoCash (formerly LOUDcash) is recognized around the world as one of the best pay-per-install affiliate programs on the Internet. ZangoCash is a subsidiary of 180solutions which also includes Zango and MetricsDirect . Every day, 7,500-10,000 ZangoCash affiliates distribute our software to users who are then connected with more than 6,000 MetricsDirect advertisers."

Details :

After the acknowledgement of an License Agreement, during Startup, the bundled EXE contacts several servers and downloads the required Adware components. The downloaded components are not checked for integrity or authenticity and are executed as soon as they are downloaded.

The Following procedures are exploitable :

1. Initial Install
2. Auto-Update function

The condition is exploitable in the following scenarios :

1. You have legitimate control over the DNS server
2. You have compromised a DNS server
3. You forge a cache poisoning attack against a vulnerable DNS server
4. You have access to the machine and change the HOST file

Redirecting static.zangocash.com to an IP address under your Control and creating the respective V-host allows you to install any type of executable on the machine where zango is being installed or currently is installed.

Release mode: Forced release, vendor has not replied.
Ref : TZO-112009 - Fortinet Generic Evasion
Vendor : http://www.fortinet.com
Security notification reaction rating : Catastrophic

Disclosure Policy :
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html


Affected products :
- t.b.a (Vendor has not reacted, please see below)

As this bug has not been reproduced by the vendor, this limited advisory relies on the assumption that my tests were conclusive and that the test environment mimics the production environment.

I. Background

Quote: "Fortinet is a leading provider of network security appliances and the leader of the unified threat management (UTM) market worldwide. Fortinet's award-winning portfolio of security gateways, subscription services, and complementary products delivers the highest level of network, content, and application security for enterprises of all sizes, managed service providers, and telecommunications carriers, while reducing total cost of ownership and providing a flexible, scalable path for expansion. "

II. Description
The parsing engine can be bypassed by a specially crafted and formatted archive file. Details are currently witheld due to other vendors that are in process of deploying patches.

A professional reaction to a vulnerability notification is a way to measure the maturity of a vendor in terms of security. Fortinet is given a grace period of two (2) weeks to reply to my notification. Failure to do so will result in POC being released in two (2) weeks.

Fortinet (as well as others) is advised to leave a specific security contact at [1] in order to simplify getting in contact with them.

As this bug has not been reproduced by the vendor, this limited advisory relies on the assumption that my tests were conclusive.

III. Impact
A general description of the impact and nature of AV Bypasses/evasions can be read at :http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

The bug results in denying the engine the possibility to inspect code within the archive. There is no inspection of the content at all.


IV. Disclosure time line

• 09/03/2009 Send proof of concept, description the terms under which I cooperate and the planned disclosure date. There is no security adress listed at [1] and hence took the industry standard security contacts addresses secure@ and security@.
  
  No reply.

• 14/03/2009 : Resending specifying this is the last attempt to disclose responsibly.
  
  No reply.

• 15/04/2009 : Fortinet published advisories for third party vendors with the address dontreply-secresearch@fortinet.com, used secresearch@fortinet.com to resend advisory.
  
  No reply.

• 17/04/2009 : Last attempt to contact, information sent to info@foritnet.com
  
  No reply, as of time of publishing

• 17/04/2009 : Release of this advisory and begin of grace period.
  
  
• 17/04/2009 : Fortinet replied instantly, investigation on going

[1] http://osvdb.org/vendor/1/Fortinet%20Inc_

Release mode: Coordinated but limited disclosure.

Ref : TZO-092009 - Nod32 Evasion RAR

Vendor : http://www.eset.com/

Security notification reaction rating : Good enough

Notification to patch window : 14 days

Interesting background statistics:
Time required to coordinate disclosure and write the advisory: 2,5 hours
Time required to find the bug : 25 minutes

Disclosure Policy :
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

Affected products :

• ESET Smart Security 4 (before 15/04/2009)
• ESET NOD32 Antivirus 4 (before 15/04/2009)
• ESET Smart Security 4 Business Edition (before 15/04/2009)
• ESET NOD32 Antivirus 4 Business Edition (before 15/04/2009)
• ESET NOD32 Antivirus for Exchange Server (before 15/04/2009)
• ESET Mail Security (before 15/04/2009)
• ESET NOD32 Antivirus for Lotus Domino Server (before 15/04/2009)
• ESET File Security (before 15/04/2009)
• ESET Novell Netware (before 15/04/2009)
• ESET DELL STORAGE SERVERS (before 15/04/2009)
• ESET NOD32 Antivirus for Linux gateway devices (before 15/04/2009)
• Command line version : NOD32 prior to 3.0.677

I. Background

Quote:"ESET develops software solutions that deliver instant, comprehensive protection against evolving computer security threats. ESET NOD32® Antivirus, is the flagship product, consistently achieves the highest accolades in all types of comparative testing and is the foundational product that builds out the ESET product line to include ESET Smart Security."
http://www.eset.com/products/eset_performance_advantages.php


II. Description

The parsing engine can be bypassed by a specially crafted and formated RAR archive. Details are currently witheld due to other vendors that are in process of deploying patches.

III. Impact

A general description of the impact and nature of AV Bypasses/evasions can be read at :
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

The bug results in denying the engine the possibility to inspect code within the RAR archive. There is no inspection of the content at all.


IV. Disclosure timeline

• 04/04/2009 : Send proof of concept, description the terms under which I cooperate and the planned disclosure date

No reply

• 09/04/2009 : Resend notification with an indication this will be the last attempt to responsibly disclose.
  
  
• 09/04/2009 : Eset acknowledges receipt and previous receipt and apologises for not being able to answer due to an internal miscommunication. Patch will be deployed on the 15th of April.

• 09/04/2009 : Ask where changelog/advisory will be posted to
  
  
• 09/04/2009 : Eset responds that credit will be included in changelogs
  http://www.eset.com/support/updates.php?pageno=3
  
  
• 17/04/2009 : Release of this advisory

Release mode: Forced release, vendor has not replied.
Ref : TZO-092009 - AVAST Generic Evasion
Vendor : http://www.avast.com

Security notification reaction rating : Catastrophic - Once woken up:ok

Disclosure Policy :
http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

Affected products :

- Known engine version to be affected - prior and post VPS:090409-0

Update : After the reaction from avast, it is clear that all versions and products are affected, however there is no plan to patch. I recommend that existing customers that care about their overall security posture (enterprise) should contact avast and ask for a patch. You are encouraged to read the time line and draw your own conclusions.

Desktop Protection

• avast! 4 Professional (impact low, reason real-time protection)
  
• avast! 4 Home Edition (impact low, reason real-time protection)
• avast! Pro Family pack (impact low, reason real-time protection)
• avast! WHS Edition (impact low, reason real-time protection)
• avast! Mac Edition (impact unknown)
  
• avast! Linux Home Edition (impact unknown)
• avast! U3 Edition (impact unknown)
• avast! 4 BART CD (impact unknown)
• avast! for PDA (impact unknown)
  

Corporate Protection

• avast! 4 Server Edition(impact high, complete bypass)
• avast! 4 Server Edition Plug-ins
• avast! 4 Exchange Server Edition (impact high, complete bypass)
• avast! 4 ISA Server Edition (impact high, complete bypass)
• avast! 4 SharePoint Server Edition (impact high, complete bypass)
• avast! 4 SMTP Server Edition (impact high, complete bypass)
• avast! 4 Lotus Domino Edition (impact high, complete bypass)
• avast! Distributed Network Manager (impact high, complete bypass)
• avast! 4 Professional (impact unknown)
• avast! 4 BART CD (impact unknown)
• avast! for Linux/Unix Server (impact high, complete bypass)
• avast! for PDA (impact unknown)
• Net.Purum (impact unknown)

OEM

• Copperfasten - Mail Firewall Appliance
• TN North Software - Interner Anywhere eMailServer
• IceWarp Software - Merak Email Server
• SmartMax Software, Inc. - MailMax Server
• NetWin Software - SurgeMail Email Server
• Hexamail Ltd. - Hexamail Guard - Antivirus option
• Bains Digital - Defender MX
  
  

I. Background

Quote: "Comprehensive network security solution for corporate customers certified and tested by ICSA and Checkmark. It provides complete server and desktop virus protection."


II. Description

The parsing engine can be bypassed by a specially crafted and formated RAR archive. Details are currently witheld.


III. Impact
A general description of the impact and nature of AV Bypasses/evasions can be read at :
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

The bug results in denying the engine the possibility to inspect code within the RAR archive. There is no inspection of the content at all.


IV. Disclosure timeline

• 14/03/2009 : Send proof of concept, description the terms under which I cooperate and the planned disclosure date. There is no security adress listed at [1] and hence took the industry standard security contacts addresses secure@ and security@. secure@avast.de, secure@alwil.com, security@alwil.com security@avast.de security@avast.com
  
  No reply.

• 10/04/2009 : Resending specifying this is the last attempt to disclose reponsibly. This time two known contact adresses that were previously used to report vulnerabilities were used: secalert@avast.com, vlk@avast.com
  
  No reply.
  
  
• 17/04/2009 : Release of this advisory and begin of grace period.
  
  
• 17/04/2009 : Avast replies quoting the mail sent on the 14/03/2009 and claims that this is a non issue because the POC would not correctly decompress.
  
  
• 17/04/2009: Reply that the POC works as expected and asked why there has been no reaction to previous notifications.
  
  No reply.
  
  
• 20/04/2009: Asked for patch time line and affected version
  
  
• 20/04/2009: Avast replies that all versions and all product ranges are affected, however "There's currently no plan to release a special patch for this as our risk assessment makes it a very low priority issue."

Addendum :
It is the responsibility of the vendor to make sure security addresses are available, known and communicated. Addresses given by avast simply bounce :

• For secure@avast.com, [Site (avast.com/195.47.75.55) said: 550 5.1.1 secure@avast.com... User unknown]
• For secalert@avast.com, [Site (avast.com/195.47.75.55) said: 550 5.1.1 secalert@avast.com... User unknown]

Avast is surely able to assess their *business risk* i.e the risk to loose customers and money; however I doubt avast can the entire cumulated risk their customers that run avast code in specific environments. What Avast should matter about is the impact it has on their application. The primary goal of an AV application is to detect malicious code, if this can be easily and comfortably evaded they are not that useful any more on gateways are they? A bug should not be rated by it technical aspects or how hard it is to be found, but should be rated by the impact, case by case.

[1] http://osvdb.org/vendor/1/ALWIL%20Software