Quicklinks: Home Contact


G-SEC™ regularly publishes advisories about vulnerabilities that we discovered during our research. G-SEC™ tries to follow responsible disclosure guidelines whenever possible.

More information »


McAfee - Generic PDF detection bypass

Release mode: Coordinated
Reference : [GSEC-49-2009] - McAfee PDF bypass
Vendor : http://www.mcafee.com
Status : Patched
CVE : none attributed yet
Credit : https://kc.mcafee.com/corporate/index?page=content&id=SB10003
           (We disagree on the CVSS rating )
Discovered by : Thierry Zoller (G-SEC)

Affected products :

I. Background

Quote: "McAfee proactively secures systems and networks from known and as yet undiscovered threats worldwide. Home users, businesses, service providers, government agencies, and our partners all trust our unmatched security expertise and have confidence in our comprehensive and proven solutions to effectively block attacks and prevent disruptions."

II. Description

Improper parsing of the PDF structure leads to evasion of detection of malicious PDF documents at scantime and runtime. This has been tested with several malicious PDF files and represents a generic evasion of all PDF signatures and heuristics.

General information about evasion/bypasses can be found at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

III. Impact

Known PDF exploits/malware may evade signature detection, 0day exploits may evade heuristics.

V. Disclosure timeline

Note: All trademarks mentioned herein belong to their respective owners.