PT-2012-6304 · Eset+31 · Eset Nod32 Antivirus+33

Published 2012-03-21 · Updated 2012-03-21

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions AhnLab V3 Internet Security version 2011.01.18.00 Avira AntiVir version 7.11.1.163 Antiy Labs AVL SDK version 2.0.3.7 avast! Antivirus versions 4.8.1351.0 through 5.0.677.0 AVG Anti-Virus version 10.0.0.1190 Bitdefender version 7.2 Quick Heal version 11.00 ClamAV version 0.96.4 Command Antivirus version 5.2.11.5 Comodo Antivirus version 7424 Emsisoft Anti-Malware version 5.1.0.1 F-Prot Antivirus version 4.6.2.117 F-Secure Anti-Virus version 9.0.16160.0 Fortinet Antivirus version 4.2.254.0 G Data AntiVirus version 21 Ikarus Virus Utilities T3 Command Line Scanner version 1.1.97.0 Jiangmin Antivirus version 13.0.900 K7 AntiVirus version 9.77.3565 Kaspersky Anti-Virus version 7.0.0.125 McAfee Anti-Virus Scanning Engine version 5.400.0.1158 McAfee Gateway version 2010.1C Microsoft Security Essentials version 2.0 NOD32 Antivirus version 5795 Norman Antivirus version 6.06.12 nProtect Anti-Virus version 2011-01-17.01 Panda Antivirus version 10.0.2.7 PC Tools AntiVirus version 7.0.3.5 Rising Antivirus version 22.83.00.03 Sophos Anti-Virus version 4.61.0 Symantec Endpoint Protection version 11 Trend Micro AntiVirus version 9.120.0.1004 Trend Micro HouseCall version 9.120.0.1004 VBA32 version 3.12.14.2 VirusBuster version 13.6.151.0

Description The TAR file parser in the listed software allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry.

Recommendations For each affected version, apply the necessary patches or updates to fix the TAR file parser issue. As a temporary workaround, consider disabling the TAR file parsing functionality until a patch is available. Restrict access to TAR archive files to minimize the risk of exploitation. Avoid using the affected software to scan TAR archives until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2012-26

Affected Products

Avg Anti-Virus

Ahnlab V3 Internet Security

Antiy Labs Avl Sdk

Avira Antivir

Bitdefender

Clamav

Command Antivirus

Comodo Antivirus

Emsisoft Anti-Malware

F-Prot Antivirus

F-Secure Anti-Virus

Fortinet Antivirus

G Data Antivirus

Ikarus Virus Utilities T3 Command Line Scanner

Jiangmin Antivirus

K7 Antivirus

Kaspersky Anti-Virus

Mcafee Anti-Virus Scanning Engine

Mcafee Gateway

Security Essentials

Eset Nod32 Antivirus

Norman Antivirus

Pc Tools Antivirus

Panda Antivirus

Quick Heal

Rising Antivirus

Sophos Anti-Virus

Symantec Endpoint Protection

Trend Micro Antivirus

Trend Micro Housecall

Vba32

Virusbuster

Avast Antivirus

Nprotect Anti-Virus

References · 18

• https://osv.dev/vulnerability/PYSEC-2012-26 · Vendor Advisory
• http://osvdb.org/80403 · Note
• http://osvdb.org/80389 · Note
• http://osvdb.org/80390 · Note
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.html · Note
• http://osvdb.org/80393 · Note
• http://securityfocus.com/bid/52623 · Note
• http://osvdb.org/80391 · Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:094 · Note
• http://osvdb.org/80406 · Note
• http://ieee-security.org/TC/SP2012/program.html · Note
• http://osvdb.org/80396 · Note
• http://osvdb.org/80395 · Note
• http://securityfocus.com/archive/1/522005 · Note
• http://osvdb.org/80409 · Note