PT-2012-3272 · Fortinet+3 · Fortinet Antivirus+3

Published 2012-03-21 · Updated 2017-12-06 · CVE-2012-1447

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fortinet Antivirus version 4.2.254.0 eSafe version 7.0.17.0 Dr.Web version 5.0.2.03300 Panda Antivirus version 10.0.2.7

Description The issue allows remote attackers to bypass malware detection by utilizing an ELF file with a modified e version field. This could potentially lead to undetected malware.

Recommendations For Fortinet Antivirus version 4.2.254.0, update the ELF file parser to correctly handle modified e version fields. For eSafe version 7.0.17.0, update the ELF file parser to correctly handle modified e version fields. For Dr.Web version 5.0.2.03300, update the ELF file parser to correctly handle modified e version fields. For Panda Antivirus version 10.0.2.7, update the ELF file parser to correctly handle modified e version fields.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1447

Affected Products

Dr.Web

Fortinet Antivirus

Panda Antivirus

Esafe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-1447 · Security Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://securityfocus.com/archive/1/522005 · Note
• http://osvdb.org/80432 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1447 · Note
• http://securityfocus.com/bid/52601 · Note