PT-2012-6300 · Sophos+6 · Sophos Anti-Virus+8

Publicado 2012-03-21 · Atualizado 2012-03-21

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Bitdefender version 7.2 Comodo Antivirus version 7424 eSafe version 7.0.17.0 F-Secure Anti-Virus version 9.0.16160.0 McAfee Anti-Virus Scanning Engine version 5.400.0.1158 McAfee Gateway version 2010.1C nProtect Anti-Virus version 2011-01-17.01 Sophos Anti-Virus version 4.61.0 Rising Antivirus version 22.83.00.03

Description The ELF file parser allows remote attackers to bypass malware detection via an ELF file with a 19040010 character sequence at a certain location.

Recommendations For Bitdefender version 7.2, consider disabling the ELF file parser until a patch is available. For Comodo Antivirus version 7424, restrict access to the ELF file parser to minimize the risk of exploitation. For eSafe version 7.0.17.0, avoid using the ELF file parser in sensitive environments until the issue is resolved. For F-Secure Anti-Virus version 9.0.16160.0, consider implementing additional malware detection measures to compensate for the vulnerable ELF file parser. For McAfee Anti-Virus Scanning Engine version 5.400.0.1158, restrict the use of the ELF file parser to trusted sources only. For McAfee Gateway version 2010.1C, consider disabling the ELF file parser as a temporary workaround. For nProtect Anti-Virus version 2011-01-17.01, implement strict access controls to the ELF file parser. For Sophos Anti-Virus version 4.61.0, consider using alternative malware detection methods until the ELF file parser is patched. For Rising Antivirus version 22.83.00.03, restrict the ELF file parser to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

PYSEC-2012-22

Produtos afetados

Bitdefender

Comodo Antivirus

F-Secure Anti-Virus

Mcafee Anti-Virus Scanning Engine

Mcafee Gateway

Rising Antivirus

Sophos Anti-Virus

Esafe

Nprotect Anti-Virus

Referências · 3

• https://osv.dev/vulnerability/PYSEC-2012-22 · Aviso do Fabricante
• http://securityfocus.com/archive/1/522005 · Nota
• http://ieee-security.org/TC/SP2012/program.html · Nota