VULHUB ™

Trend Micro's InterScan VirusWall is a product designed to stop the spread of viruses and worms through email. To do so, it filters SMTP traffic for various signatures which match those of viruses. It is possible to evade scanning if malicious code is within a malformed email attachment. If there are more '=' characters than required at the end of a base64 encoded attachment, InterScan will fail to scan the data and let it pass through unchecked. However, InterScan does record when this error occurs; it writes the following to its system logs: base64: Unexpected EOF seen The NewApt worm is known to exploit this vulnerability.

Trend Micro's InterScan VirusWall is a product designed to stop the spread of viruses and worms through email. To do so, it filters SMTP traffic for various signatures which match those of viruses. It is possible to evade scanning if malicious code is within a malformed email attachment. If there are more '=' characters than required at the end of a base64 encoded attachment, InterScan will fail to scan the data and let it pass through unchecked. However, InterScan does record when this error occurs; it writes the following to its system logs: base64: Unexpected EOF seen The NewApt worm is known to exploit this vulnerability.