Check Point Advisories

Multiple AV Vendor Invalid Archive Checksum Bypass

Check Point Reference: CPAI-2005-206
Date Published: 24 May 2010
Severity: High
Last Updated: Tuesday 08 January, 2013
Source:
Protection Provided by:

Security Gateway
R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description Anti-virus products provide protection against dangerous content such as viruses, trojans, worms and other destructive programs. They are capable of detecting malicious content not only within regular files but also within compressed archives such as ZIP files. There exists a vulnerability in the way multiple anti-virus products scan ZIP archive files. The vulnerable component skips scanning of archives with invalid CRC checksums. An attacker can leverage this vulnerability to bypass anti-virus protection and deliver malicious content to the target. If a crafted ZIP archive file is delivered to a system which performs on-access scanning, the malicious content will be detected before it is executed, mitigating the impact of this vulnerability. A malicious ZIP archive containing known trojans or viruses may be downloaded and stored on the local file system without the affected product raising a warning or otherwise informing the user of a potential threat. The product in such a case exhibits ineffective and misleading behavior.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

  1. In the IPS tab, click Protections and find the Multiple AV Vendor Invalid Archive Checksum Bypass protection using the Search tool and Edit the protection's settings.
  2. Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name:  Content Protection Violation.
Attack Information:  Multiple AV vendor invalid archive checksum bypass

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK