PT-2012-3257 · Ikarus+3 · Ikarus Virus Utilities+3

Published 2012-03-21 · Updated 2012-04-13 · CVE-2012-1432

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Emsisoft Anti-Malware version 5.1.0.1 eSafe version 7.0.17.0 Ikarus Virus Utilities T3 Command Line Scanner version 1.1.97.0 Panda Antivirus version 10.0.2.7

Description The issue allows remote attackers to bypass malware detection. This is achieved via an EXE file containing a specific character sequence 57696E5A6970 at a certain location, which is not properly handled by the Microsoft EXE file parser in the affected software.

Recommendations For Emsisoft Anti-Malware version 5.1.0.1, consider updating to a newer version that addresses this issue. For eSafe version 7.0.17.0, consider updating to a newer version that addresses this issue. For Ikarus Virus Utilities T3 Command Line Scanner version 1.1.97.0, consider updating to a newer version that addresses this issue. For Panda Antivirus version 10.0.2.7, consider updating to a newer version that addresses this issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1432

Affected Products

Emsisoft Anti-Malware

Ikarus Virus Utilities

Panda Antivirus

Esafe

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-1432 · Security Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://securityfocus.com/archive/1/522005 · Note