PT-2012-3287 · Emsisoft+11 · Emsisoft Anti-Malware+11

Benedikt Driessen + 4 · Published 2012-03-21 · Updated 2017-08-29 · CVE-2012-1462

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AhnLab V3 Internet Security version 2011.01.18.00 AVG Anti-Virus version 10.0.0.1190 Quick Heal version 11.00 Emsisoft Anti-Malware version 5.1.0.1 eSafe version 7.0.17.0 Fortinet Antivirus version 4.2.254.0 Ikarus Virus Utilities T3 Command Line Scanner version 1.1.97.0 Jiangmin Antivirus version 13.0.900 Kaspersky Anti-Virus version 7.0.0.125 Norman Antivirus version 6.06.12 Sophos Anti-Virus version 4.61.0 Symantec Endpoint Protection 11 with AVEngine version 20101.3.0.103

Description The issue allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning. This is related to the ZIP file parser in the affected software.

Recommendations For AhnLab V3 Internet Security version 2011.01.18.00, update to a newer version that fixes the ZIP file parser issue. For AVG Anti-Virus version 10.0.0.1190, update to a newer version that fixes the ZIP file parser issue. For Quick Heal version 11.00, update to a newer version that fixes the ZIP file parser issue. For Emsisoft Anti-Malware version 5.1.0.1, update to a newer version that fixes the ZIP file parser issue. For eSafe version 7.0.17.0, update to a newer version that fixes the ZIP file parser issue. For Fortinet Antivirus version 4.2.254.0, update to a newer version that fixes the ZIP file parser issue. For Ikarus Virus Utilities T3 Command Line Scanner version 1.1.97.0, update to a newer version that fixes the ZIP file parser issue. For Jiangmin Antivirus version 13.0.900, update to a newer version that fixes the ZIP file parser issue. For Kaspersky Anti-Virus version 7.0.0.125, update to a newer version that fixes the ZIP file parser issue. For Norman Antivirus version 6.06.12, update to a newer version that fixes the ZIP file parser issue. For Sophos Anti-Virus version 4.61.0, update to a newer version that fixes the ZIP file parser issue. For Symantec Endpoint Protection 11 with AVEngine version 20101.3.0.103, update to a newer version that fixes the ZIP file parser issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-1462

Affected Products

Avg Anti-Virus

Ahnlab V3 Internet Security

Emsisoft Anti-Malware

Fortinet Antivirus

Ikarus Virus Utilities T3 Command Line Scanner

Jiangmin Antivirus

Kaspersky Anti-Virus

Norman Antivirus

Quick Heal

Sophos Anti-Virus

Symantec Endpoint Protection

Esafe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2012-1462 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1462 · Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://securityfocus.com/archive/1/522005 · Note
• http://securityfocus.com/bid/52613 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74310 · Note