PT-2012-3285 · Esafe+7 · Esafe+7

Benedikt Driessen + 4 · Published 2012-03-21 · Updated 2017-08-29 · CVE-2012-1460

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Antiy Labs AVL SDK version 2.0.3.7 Quick Heal version 11.00 Command Antivirus version 5.2.11.5 eSafe version 7.0.17.0 F-Prot Antivirus version 4.6.2.117 Jiangmin Antivirus version 13.0.900 K7 AntiVirus version 9.77.3565 VBA32 version 3.12.14.2

Description The issue allows remote attackers to bypass malware detection by using a .tar.gz file with stray bytes at the end. This is related to the Gzip file parser in the affected software.

Recommendations For Antiy Labs AVL SDK version 2.0.3.7, update to a version that fixes the Gzip file parser issue. For Quick Heal version 11.00, update to a version that fixes the Gzip file parser issue. For Command Antivirus version 5.2.11.5, update to a version that fixes the Gzip file parser issue. For eSafe version 7.0.17.0, update to a version that fixes the Gzip file parser issue. For F-Prot Antivirus version 4.6.2.117, update to a version that fixes the Gzip file parser issue. For Jiangmin Antivirus version 13.0.900, update to a version that fixes the Gzip file parser issue. For K7 AntiVirus version 9.77.3565, update to a version that fixes the Gzip file parser issue. For VBA32 version 3.12.14.2, update to a version that fixes the Gzip file parser issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1460

Affected Products

Avl Sdk

Command Antivirus

F-Prot Antivirus

Jiangmin Antivirus

K7 Antivirus

Quick Heal

Vba32

Esafe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-1460 · Security Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://securityfocus.com/archive/1/522005 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74308 · Note
• http://securityfocus.com/bid/52629 · Note