Sophos AntiVirus Engine on Cisco IronPort C370 does not detect Microsoft vulnerability CVE-2012-0158 !

[mikelpham88]

Hi guys,

Today my Cisco IronPort has updated the lastest Sophos AntiVirus Engine and IDE Rules as below:

 

But some Office file that has Virus to Exploit Microsoft vulnerability CVE-2012-0158 are still able to pass through the AV Scanning Process (mark as Negative).

I have check with VirusTotal and have found that Sophos does not recognize this vulnerability right now but another Email Security Device (like FortiMail) does:

So how can i send a notification to IronPort Developper team to make them aware of this threat ??

Thank you so much :)

[Mathew Huynh]

Hey Mikel,

If you're able to open a TAC case, you can engage TAC with the viral attachment for review and the TAC team can reach out to Sophos to check for definition match/updates.

Regards,

Matthew

[mikelpham88]

Thanks Mathew for your reply,

Unfortunately, my license of support has expired (Although the device's license is still valid) so that i could not open a TAC Support Request.

Is there anyway else that i could notify Cisco for our problem ??

[Mathew Huynh]

Could you zip up the file attachment with a password and provide it to me? 

[mikelpham88]

Oow, thank Mathew so much,

i send you the viral attachment

please have a look at this with me :D

Password is: iron@Sophos123

[mikelpham88]

Hi Mathew,

do you have any clue to solve this problem :)

The IronPort updated the lastest Engine but it still does not detect this virus.

[Mathew Huynh]

Hey Mikel,

Sorry about that, i missed the last update. I'll send these to Sophos and see what they say.

Regards,

Matthew

[mikelpham88]

Thanks Mathew,

i'm looking forward to your reply.

Very thank for your attention about my own problem :)

[Mathew Huynh · Accepted solution]

Sophos updated:

bangphanconggiamsat2015.doc >> New detection: Exp/20120158-BM
danhsachthongtinvacauthu20~.doc  >> New detection: Exp/20120158-BM
Tai lieu Dien dan (2).doc  >> New detection: Exp/20120158-BM

[mikelpham88]

Very thanks to Mathew,

I checked on Virus Total and Sophos Engine has detected this viral

And i have sent a test message with viral attachment from Live Mail to my Email System and IronPort has detected vulnerability

Finally, thank Mathew again for your very kind help :)

[Mathew Huynh]

Happy to help.