PT-2020-20610 · Quick Heal · Quick Heal Total Security+7

Thierry Zoller · Published 2020-02-24 · Updated 2022-04-18 · CVE-2020-9362

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quick Heal Total Security versions (affected versions not specified) Quick Heal Home Security versions (affected versions not specified) Quick Heal Total Security Multi-Device versions (affected versions not specified) Quick Heal Internet Security versions (affected versions not specified) Quick Heal Total Security for Mac versions (affected versions not specified) Quick Heal AntiVirus Pro versions (affected versions not specified) Quick Heal AntiVirus for Server versions (affected versions not specified) Quick Heal Total Security for Android versions (affected versions not specified)

Description The issue allows virus-detection bypass via a crafted GPFLAG in a ZIP archive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2020-9362

Affected Products

Quick Heal Antivirus Pro

Quick Heal Antivirus For Server

Quick Heal Home Security

Quick Heal Internet Security

Quick Heal Total Security

Quick Heal Total Security Multi-Device

Quick Heal Total Security For Android

Quick Heal Total Security For Mac

References · 7

• https://osv.dev/vulnerability/CVE-2020-9362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9362 · Security Note
• http://packetstormsecurity.com/files/156580/QuickHeal-Generic-Malformed-Archive-Bypass.html · Note
• http://seclists.org/fulldisclosure/2020/Mar/14 · Note
• https://blog.zoller.lu/p/from-low-hanging-fruit-department_24.html · Note
• https://t.me/defcon_news/40650 · Telegram Post
• https://blog.zoller.lu/p/tzo-20-2020-quickheal-malformed-archive.html · Note