PT-2012-3249 · Antiy+5 · Antiy Labs Avl Sdk+5

Published 2012-03-21 · Updated 2012-08-14 · CVE-2012-1424

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Antiy Labs AVL SDK version 2.0.3.7 Quick Heal version 11.00 Jiangmin Antivirus version 13.0.900 Norman Antivirus version 6.06.12 PC Tools AntiVirus version 7.0.3.5 Sophos Anti-Virus version 4.61.0

Description The issue allows remote attackers to bypass malware detection via a POSIX TAR file with a specific character sequence at a certain location. This is achieved by including a 19040010 character sequence in the TAR file.

Recommendations For Antiy Labs AVL SDK version 2.0.3.7, update the TAR file parser to correctly handle the POSIX TAR file format. For Quick Heal version 11.00, modify the malware detection mechanism to account for the specific character sequence. For Jiangmin Antivirus version 13.0.900, adjust the TAR file parsing logic to prevent bypassing of malware detection. For Norman Antivirus version 6.06.12, implement a fix to properly handle the 19040010 character sequence in TAR files. For PC Tools AntiVirus version 7.0.3.5, update the antivirus engine to detect malware in TAR files with the specified character sequence. For Sophos Anti-Virus version 4.61.0, apply a patch to the TAR file parser to prevent malware detection bypass.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1424

Affected Products

Antiy Labs Avl Sdk

Jiangmin Antivirus

Norman Antivirus

Pc Tools Antivirus

Quick Heal

Sophos Anti-Virus

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-1424 · Security Note
• http://osvdb.org/80391 · Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://securityfocus.com/archive/1/522005 · Note
• http://osvdb.org/80392 · Note
• http://osvdb.org/80409 · Note
• http://osvdb.org/80390 · Note