Stay Secure with the Latest Linux Advisories

security advisorygentoolow severity

Gentoo: GLSA 200410-31 Low: Archive::Zip Virus Detection Evasion

Email virus scanning software relying on Archive::Zip can be fooled into thinking a ZIP attachment is empty while it contains a virus, allowing detection evasion. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200410-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Archive::Zip: Virus detection evasion Date: October 29, 2004 Bugs: #68616 ID: 200410-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Email virus scanning software relying on Archive::Zip can be fooled into thinking a ZIP attachment is empty while it contains a virus, allowing detection evasion. Background ========= Archive::Zip is a Perl module containing functions to handle ZIP archives. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-perl/Archive-Zip < 1.14 > = 1.14 Description ========== Archive::Zip can be used by email scanning software (like amavisd-new) to uncompress attachments before virus scanning. By modifying the uncompressed size of archived files in the global header of the ZIP file, it is possible to fool Archive::Zip into thinking some files inside the archive have zero length. Impact ===== An attacker could send a carefully crafted ZIP archive containing a virus file and evade detection on some email virus-scanning software relying on Archive::Zip for decompression. Workaround ========= There is no known workaround at this time. Resolution ========= All Archive::Zip users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-perl/Archive-Zip-1.14" References ========= [ 1 ] iDEFENSE Security Advisory 10.18.04 [ 2 ] rt.cpan.org bug #8077 https://rt.cpan.org/Public/Bug/Display.html Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200410-31 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/1.0/ . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Adviso. email, virus, scanning, software, relying, archive, fooled, thinking, attachment. . Severity: Low. LinuxSecurity.com Team

Oct 29, 2004 •Low Gentoo