Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Antivirus Tools Underperform When Tested in LinuxWorld 'Fight Club'

In LinuxWorld 'fight club,' only three antivirus tools catch all the viruses thrown at them

Oh, antivirus products. They're a commodity item, right? They're all pretty much the same.

Wrong, according to a live test of antivirus products for Linux conducted last night at the LinuxWorld event in San Francisco.

In an antivirus "fight club" conducted in front of an audience by network gateway vendor Untangle at the show, 10 antivirus products were confronted with 25 viruses, many submitted by members of the audience. The goal: to see whether the AV tools would catch 'em all.

The results: Only three of the antivirus tools caught and blocked all 25 viruses thrown at them. One tool caught fewer than 10 percent.

"What's surprising about a test like this is how much difference there is between the antivirus products' performance," says Dirk Morris, CTO and co-founder of Untangle. "Some of the products you think will do well don't, and some of the lesser-known products, like open source tools, end up doing well."

The "winners" in last night's contest were Linux tools from Kaspersky and Symantec, and the open source Clam AV. All three tools caught 100 percent of the viruses they encountered. FProt and Sophos caught 94 percent; McAfee caught 89 percent; and GlobalHauri, Fortinet, and SonicWall caught 61 percent.

One product, WatchGuard's Linux AV tool, caught fewer than 6 percent of the viruses sent to it. "We're not exactly sure what the problem with WatchGuard is," says Morris. "The test was set up the same way for all of the vendors."

WatchGuard disputes the test results, stating that it uses ClamAV -- one of the products that caught all of the viruses -- in its own product. "We don't see how the results could be valid -- our product uses ClamAV," a spokesman says.

Untangle first conducted the AV "fight club" two years ago, when it was trying to decide which AV tool to include in its network gateway, which offers a variety of security and network performance tools. "It's a simple test," Morris says. "We just wanted to see which tools worked best."

ClamAV, an open source product, finished at the top of that first test, just as it did last night, and Untangle chose to use the open source product in its gateway. "Open source AV products often get overlooked because they aren't very well marketed," Morris observes. "When we looked at ClamAV's Website a couple of years ago, it was really bad. But the product itself works as well or better than the most expensive tools out there."

For last night's test, Untangle accepted viruses submitted by audience members and other interested parties, and its test set is available online. No zero-day exploits were included. "Most of these are everyday viruses. Some of them have been around for years," Morris says. "These are all things that an antivirus tool should catch."

— Tim Wilson, Site Editor, Dark Reading

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...