[TZO-08-2009] Bitdefender generic bypass/evasion
Thierry Zoller <[email protected]> Fri, 17 Apr 2009 16:08:49 +0200
| Newsgroups | gmane.comp.security.full-disclosure,gmane.comp.security.ntbugtraq,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fXwoKICBGcm9tIHRoZSBsb3ctaGFuZ2luZy1mcnVpdC1kZXBhcnRtZW50IC0g Qml0ZGVmZW5kZXIgYnlwYXNzL2V2YXNpb24KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwoKUmVsZWFzZSBtb2RlOiBD b29yZGluYXRlZCBidXQgbGltaXRlZCBkaXNjbG9zdXJlLgpSZWYgICAgICAgICA6IFRaTy0wODIw MDkgLSBCaXRkZWZlbmRlciBFdmFzaW9uIENBQgpXV1cgICAgICAgICA6IGh0dHA6Ly9ibG9nLnpv bGxlci5sdS8yMDA5LzA0L2JpdGRlZmVuZGVyLWdlbmVyaWMtYnlwYXNzZXZhc2lvbi1jYWIuaHRt bApWZW5kb3IgICAgICA6IGh0dHA6Ly93d3cuYml0ZGVmZW5kZXIuY29tClNlY3VyaXR5IG5vdGlm aWNhdGlvbiByZWFjdGlvbiByYXRpbmcgOiBHb29kCk5vdGlmaWNhdGlvbiB0byBwYXRjaCB3aW5k b3cgOiAxIGRheSAoISkKCkludGVyc3RpbmcgYmFja3JvdW5kIHN0YXRpc3RpY3M6ClRpbWUgcmVx dWlyZWQgdG8gY29vcmRpbmF0ZSBkaXNjbG9zdXJlIGFuZCB3cml0ZSB0aGUgYWR2aXNvcnk6IDIg aG91cnMKVGltZSByZXF1aXJlZCB0byBmaW5kIHRoZSBidWcgOiAxMCBtaW51dGVzCgpEaXNjbG9z dXJlIFBvbGljeSA6IApodHRwOi8vYmxvZy56b2xsZXIubHUvMjAwOC8wOS9ub3RpZmljYXRpb24t YW5kLWRpc2Nsb3N1cmUtcG9saWN5Lmh0bWwKCkFmZmVjdGVkIHByb2R1Y3RzIDogCi0gQml0ZGVm ZW5kZXIgQW50aXZpcnVzIDIwMDkgKHByZSB1cGRhdGUgMTMvMDQvMjAwOSkKLSBCaXRkZWZlbmRl ciBJbnRlcm5ldCBTZWN1cml0eSAyMDA5IChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCi0gQml0ZGVm ZW5kZXIgVG90YWwgU2VjdXJpdHkgMjAwOSAocHJlIHVwZGF0ZSAxMy8wNC8yMDA5KQotIEJpdGRl ZmVuZGVyIFNtYWxsIE9mZmljZSBTZWN1cml0eSAocHJlIHVwZGF0ZSAxMy8wNC8yMDA5KQotIEJp dGRlZmVuZGVyIGZvciBGaWxlc2VydmVycyAocHJlIHVwZGF0ZSAxMy8wNC8yMDA5KQotIEJpdGRl ZmVuZGVyIGZvciBTYW1iYSAocHJlIHVwZGF0ZSAxMy8wNC8yMDA5KQotIEJpdGRlZmVuZGVyIGZv ciBTaGFyZXBvaW50IChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCi0gQml0ZGVmZW5kZXIgU2VjdXJp dHkgZm9yIEV4Y2hhbmdlIChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCi0gQml0ZGVmZW5kZXIgU2Vj dXJpdHkgZm9yIE1haWxzZXJ2ZXJzIChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCi0gQml0ZGVmZW5k ZXIgZm9yIElTQSBTZXJ2ZXJzIChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCi0gQml0ZGVmZW5kZXIg Q2xpZW50IHNlY3VyaXR5IChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCgpCdW5kbGVzOgotIEJpdERl ZmVuZGVyIEJ1c2luZXNzIFNlY3VyaXR5IChwcmUgdXBkYXRlIDEzLzA0LzIwMDkpCi0gQml0ZGVm ZW5kZXIgQW50aXZpcnVzIGZvciBVbmljZXMgKHByZSB1cGRhdGUgMTMvMDQvMjAwOSkKLSBCaXRk ZWZlbmRlciBDb3Jwb3JhdGUgU2VjdXJpdHkgKHByZSB1cGRhdGUgMTMvMDQvMjAwOSkKLSBCaXRk ZWZlbmRlciBTQlMgU2VjdXJpdHkgKHByZSB1cGRhdGUgMTMvMDQvMjAwOSkKCkkuIEJhY2tncm91 bmQKfn5+fn5+fn5+fn5+fgpCaXREZWZlbmRlcpkgIHByb3ZpZGVzICBzZWN1cml0eSAgc29sdXRp b25zICB0byAgc2F0aXNmeSAgdGhlICAgIHByb3RlY3Rpb24KcmVxdWlyZW1lbnRzICBvZiAgdG9k YXkncyAgY29tcHV0aW5nICBlbnZpcm9ubWVudCwgICBkZWxpdmVyaW5nICAgZWZmZWN0aXZlCnRo cmVhdCBtYW5hZ2VtZW50IGZvciBvdmVyIDQxIG1pbGxpb24gaG9tZSAgYW5kICBjb3Jwb3JhdGUg IHVzZXJzICBpbiAgbW9yZQp0aGFuIDEwMCBjb3VudHJpZXMuIEJpdERlZmVuZGVyLCBhIGRpdmlz aW9uIG9mIFNPRlRXSU4sICAgaXMgIGhlYWRxdWFydGVyZWQKaW4gQnVjaGFyZXN0LCBSb21hbmlh IGFuZCBoYXMgb2ZmaWNlcyBpbiAgVGV0dG5hbmcsICAgR2VybWFueSwgICBCYXJjZWxvbmEsClVu aXRlZCAgS2luZ2RvbSwgICBEZW5tYXJrLCAgIFNwYWluICBhbmQgIEZvcnQgIExhdWRlcmRhbGUg IChGTCksICAgICAgVVNBLgoKCgpJSS4gRGVzY3JpcHRpb24Kfn5+fn5+fn5+fn5+fn5+ClRoZSBw YXJzaW5nIGVuZ2luZSBjYW4gYmUgYnlwYXNzZWQgYnkgYSBzcGVjaWFsbHkgY3JhZnRlZCBhbmQg Zm9ybWF0ZWQKQ0FCIGFyY2hpdmUuIERldGFpbHMgYXJlIGN1cnJlbnRseSB3aXRoZWxkIGR1ZSB0 byBvdGhlciB2ZW5kb3JzIHRoYXQgYXJlIAppbiBwcm9jZXNzIG9mIGRlcGxveWluZyBwYXRjaGVz LgoKSUlJLiBJbXBhY3QKfn5+fn5+fn5+fn4KQSBnZW5lcmFsIGRlc2NyaXB0aW9uIG9mIHRoZSBp bXBhY3QgYW5kIG5hdHVyZSBvZiBBViBCeXBhc3Nlcy9ldmFzaW9ucwpjYW4gYmUgcmVhZCBhdCA6 IApodHRwOi8vYmxvZy56b2xsZXIubHUvMjAwOS8wNC9jYXNlLWZvci1hdi1ieXBhc3Nlc2V2YXNp b25zLmh0bWwKClRoZSBidWcgcmVzdWx0cyBpbiBkZW55aW5nIHRoZSBlbmdpbmUgdGhlIHBvc3Np YmlsaXR5IHRvIGluc3BlY3QKY29kZSB3aXRoaW4gdGhlIENBQiBhcmNoaXZlLiBUaGVyZSBpcyBu byBpbnNwZWN0aW9uIG9mIHRoZSBjb250ZW50CmF0IGFsbC4KCgpJVi4gRGlzY2xvc3VyZSB0aW1l bGluZQp+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+CjEzLzA0LzIwMDkgOiBTZW5kIHByb29mIG9m IGNvbmNlcHQsIGRlc2NyaXB0aW9uIHRoZSB0ZXJtcyB1bmRlciB3aGljaCAKICAgICAgICAgICAg IEkgY29vcGVyYXRlIGFuZCB0aGUgcGxhbm5lZCBkaXNjbG9zdXJlIGRhdGUKICAgICAgICAgICAg ICAgICAgICAgICAgIAoxNC8wNC8yMDA5IDogQml0ZGVmZW5kZXIgcmVzcG9uZHMgdGhhdCB0aGUg cHJvYmxlbSB3YXMgZml4ZWQgYnkgYW4gCiAgICAgICAgICAgICBhdXRvbWF0aWMgdXBkYXRlIG9u IHRoZSAxMy8wNC8yMDA5CiAgICAgICAgICAgICAgICAgICAgICAgICAKMTYvMDQvMjAwOSA6IEFz a2VkIHdoYXQgcHJvZHVjdCBsaW5lIGFuZCB2ZXJzaW9uIGhhcyBiZWVuIGFmZmVjdGVkIGFuZAog ICAgICAgICAgICAgYSBDVkUgbnVtYmVyLiAgICAgICAgICAgCgoxNS8wNC8yMDA5IDogQml0ZGVm ZW5kZXIgc3RhdGVzIHRoYXQgIkFsbCAgb3VyICBwcm9kdWN0cyBhcmUgYWZmZWN0ZWQgCiAgICAg ICAgICAgICBieSB0aGlzIHByb2JsZW0uIFdlIGRvbid0IGhhdmUgYSBDVkUgbnVtYmVyIi4KCjE3 LzA0LzIwMDkgOiBSZWxlYXNlIG9mIHRoaXMgYWR2aXNvcnkKCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCkZ1bGwtRGlzY2xvc3VyZSAtIFdlIGJlbGlldmUg aW4gaXQuCkNoYXJ0ZXI6IGh0dHA6Ly9saXN0cy5ncm9rLm9yZy51ay9mdWxsLWRpc2Nsb3N1cmUt Y2hhcnRlci5odG1sCkhvc3RlZCBhbmQgc3BvbnNvcmVkIGJ5IFNlY3VuaWEgLSBodHRwOi8vc2Vj dW5pYS5jb20v