[TZO-16-2020] - F-SECURE Generic Malformed Container bypass (GZIP)

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->
<a href="/fulldisclosure/"><img src="/images/fulldisclosure-logo.png" class="l-logo right" alt="fulldisclosure logo" width="80"></a>
<h2 class="m-list"><a href="/fulldisclosure/">Full Disclosure</a>
mailing list archives</h2>
<!--X-User-Header-End-->
<!--X-TopPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="31"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#33">By Date</a>
<a href="34"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="31"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#33">By Thread</a>
<a href="34"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<form class="nst-search center" action="/search/fulldisclosure">
<input class="nst-search-q" name="q" type="search" placeholder="List Archive Search">
<button class="nst-search-button" title="Search">
<img style="width:100%;aspect-ratio:1/1;" alt="" aria-hidden="true" src="/shared/images/nst-icons.svg#search">
</button>
</form>

</div>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
<h1 class="m-title">[TZO-16-2020] - F-SECURE Generic Malformed Container bypass	(GZIP)</h1>
<hr>
<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->


<em>From</em>: Thierry Zoller &lt;thierry () zoller lu&gt;


<em>Date</em>: Mon, 24 Feb 2020 10:38:50 +0100


<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->
<hr>
<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
<pre style="margin: 0em;">________________________________________________________________________

                From the low-hanging-fruit-department
        F-SECURE Generic Malformed Container bypass (GZIP)
________________________________________________________________________

</pre><tt>Ref             : [TZO-16-2020] - F-SECURE Generic Malformed Container 
</tt><tt>bypass (GZIP)
</tt><pre style="margin: 0em;">Vendor          : F-SECURE
Status          : Patched
CVE             : CVE-2020-9342
</pre><tt>Blog            : 
</tt><tt><a rel="nofollow" href="https://blog.zoller.lu/p/tzo-16-2020-f-secure-generic-malformed.html">https://blog.zoller.lu/p/tzo-16-2020-f-secure-generic-malformed.html</a>
</tt><pre style="margin: 0em;">Vulnerability Dislosure Policy: <a rel="nofollow" href="https://caravelahq.com/b/policy/20949">https://caravelahq.com/b/policy/20949</a>

Affected Products
=================
F-Secure Email and Server Security
F-Secure Internet GateKeeper
F-SECURE CLOUD PROTECTION FOR SALESFORCE

Linux below  17.0.605.474

I. Background
----------------------------
</pre><tt>Quote: "Unprecedented challenges threaten to undermine the very survival 
</tt><tt>of society. Only unprecedented innovation can prevent irreversible 
</tt><tt>disasters. This is only possible if we
</tt><pre style="margin: 0em;">trust the technology that can bring us together.

</pre><tt>From our humble beginnings more than thirty years ago, F-Secure has 
</tt><tt>grown into a reliable cyber security leader, earning the trust of 
</tt><tt>organizations and people around the world."
</tt><pre style="margin: 0em;">
II. Description
----------------------------
</pre><tt>The parsing engine supports the GZIP Archive. The parsing engine can be 
</tt><tt>bypassed by manipulating a GZIP archive (Compression Method). This way 
</tt><tt>the User can extract the file but the AV Engine cannot giving the file a 
</tt><tt>clean pass.
</tt><pre style="margin: 0em;">

III. Impact
----------------------------
</pre><tt>Impacts depends on the contextual use of the product and engine within 
</tt><tt>the organisation of a customer. Gateway Products (Email, HTTP Proxy etc) 
</tt><tt>may allow the file through unscanned and give it a clean bill of health. 
</tt><tt>Server side AV software will not be able to discover
</tt><tt>any code or sample contained within this ISO file and it will not raise 
</tt><tt>suspicion even  if you know exactly what you are looking for (Which is 
</tt><tt>for example great to hide your implants
</tt><pre style="margin: 0em;">or Exfiltration/Pivot Server).

</pre><tt>There is a lot more to be said about this bug class, so rather than bore 
</tt><tt>you with it in this advisory I provide a link to my 2009 blog post
</tt><pre style="margin: 0em;"><a rel="nofollow" href="http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html">http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html</a>

IV. Patch / Advisory
----------------------------
</pre><tt>- For the unix version (IGK) the fix was released on 20th January with 
</tt><tt>library version 17.0.605.474
</tt><tt>- For Windows the version was already out in December 2019. There were 
</tt><tt>also avira's fixes as well.
</tt><pre style="margin: 0em;">
</pre><tt>"We can conclude that January 20th date, since that is when the final 
</tt><tt>fixes went out to production."
</tt><pre style="margin: 0em;">
V. Disclosure timeline
----------------------------

</pre><tt>We would like to thank F-Secure for their customer oriented way of 
</tt><tt>handling this vulnerability.
</tt><pre style="margin: 0em;">
- NOV 14 2019
Initiated Vulnerability coordination

- FEB 05 2020
F-Secure notifies me that they have patched the flaw.


_______________________________________________
Sent through the Full Disclosure mailing list
<a rel="nofollow" href="https://nmap.org/mailman/listinfo/fulldisclosure">https://nmap.org/mailman/listinfo/fulldisclosure</a>
Web Archives &amp; RSS: <a rel="nofollow" href="http://seclists.org/fulldisclosure/">http://seclists.org/fulldisclosure/</a>

</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->
<div class="nav-bar">
<div class="nav-link">
<a href="31"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="date.html#33">By Date</a>
<a href="34"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
<div class="nav-link">
<a href="31"><img src="/images/left-icon-16x16.png" alt="Previous" width="16" height="16"></a>
<a href="index.html#33">By Thread</a>
<a href="34"><img src="/images/right-icon-16x16.png" alt="Next" width="16" height="16"></a>
</div>
</div>
<h3 class="m-thread">Current thread:</h3>
<ul class="thread">
<li><strong>[TZO-16-2020] - F-SECURE Generic Malformed Container bypass	(GZIP)</strong> <em>Thierry Zoller (Feb 27)</em>
</li></ul>


<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
<p>