There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask an EXE file into one that looks like a text document.
What applications are vulnerable to this threat, and what are the mitigations/countermeasures?
- Mitigate Windows Explorer with AntiVirus product XXX
- Filter email attachments using YYY
- Limit Mac exposure with product iZ
My personal experience suggests that most products need updating or configuration to prevent end users from being taken advantage of.
Perhaps calling 'Backwards Unicode names' a vulnerability is incorrect of me. However I consider any application that does not provide the controls to mitigate hostile use a vulnerability. Perhaps this security is regulated to a class of products such as email filters or AV products.
My intent is to identity the products needed to prevent this from being exploited and maintain the reasonable and appropriate use of B.U.N.'s.