PT-2012-3255 · Bitdefender+6 · Bitdefender+8

Published 2012-03-21 · Updated 2012-04-13 · CVE-2012-1430

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bitdefender version 7.2 Comodo Antivirus version 7424 eSafe version 7.0.17.0 F-Secure Anti-Virus version 9.0.16160.0 McAfee Anti-Virus Scanning Engine version 5.400.0.1158 McAfee Gateway version 2010.1C nProtect Anti-Virus version 2011-01-17.01 Sophos Anti-Virus version 4.61.0 Rising Antivirus version 22.83.00.03

Description The ELF file parser in the affected software allows remote attackers to bypass malware detection via an ELF file with a 19040010 character sequence at a certain location.

Recommendations For Bitdefender version 7.2, consider disabling the ELF file parser until a patch is available. For Comodo Antivirus version 7424, restrict access to the ELF file parser to minimize the risk of exploitation. For eSafe version 7.0.17.0, avoid using the ELF file parser in sensitive environments until the issue is resolved. For F-Secure Anti-Virus version 9.0.16160.0, consider implementing additional malware detection measures to compensate for the vulnerable ELF file parser. For McAfee Anti-Virus Scanning Engine version 5.400.0.1158, restrict the use of the ELF file parser to trusted sources only. For McAfee Gateway version 2010.1C, consider disabling the ELF file parser as a temporary workaround. For nProtect Anti-Virus version 2011-01-17.01, implement strict access controls to the ELF file parser to minimize exploitation risk. For Sophos Anti-Virus version 4.61.0, consider updating the malware detection rules to account for the vulnerable ELF file parser. For Rising Antivirus version 22.83.00.03, restrict the use of the ELF file parser to necessary functions only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1430

Affected Products

Bitdefender

Comodo Antivirus

F-Secure Anti-Virus

Mcafee Anti-Virus Scanning Engine

Mcafee Gateway

Rising Antivirus

Sophos Anti-Virus

Esafe

Nprotect Anti-Virus

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-1430 · Security Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://securityfocus.com/archive/1/522005 · Note