Dailydave mailing list archives

VML Exploits and IDP-AV Evasion

From: "Arsal, Ertunga" <EArsal () techdata de>
Date: Tue, 26 Sep 2006 18:00:01 +0200


Hello All, 


Do you think that the security products are getting more into creating an illusion of safety, thus making people more 
vulnerable? The issue is the vulnerabilities they are not able to catch properly. One of them is the recent vml 
exploit. Okay we know it there are millions of ways to create an html page that could execute, which means no signature 
would be reliable. 

I did a basic test. Just went to http://www.isotf.org/zert/testvml.htm with IE.
 
ISS Proventia blocked it. Tested without Proventia. This time Symantec AV caught it. Excellent!
 
Then I went to the second line: <html xmlns:v="urn:schemas-microsoft-com:vml" 
xmlns:o="urn:schemas-microsoft-com:office:office">
Changed it from "urn:schemas-microsoft-com:vml" to "urn:schemas-microsoft-com: vml" by putting one space and uploaded 
to a web server.

Proventia didn't catch a thing nor the Symantec av. IE crashed. 

So, what is the trend now? Having only protection against public test exploits? Is this only a publicity thing than 
proper protection?


Ertunga Arsal






 
 
 
 
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave

Current thread:

VML Exploits and IDP-AV Evasion Arsal, Ertunga (Sep 26)
- Re: VML Exploits and IDP-AV Evasion Lorenzo Hernández García-Hierro (Sep 26)