CVE-2012-1419 The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOT...
MediumCVSS 4.3
EPSS 39.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/clamav(Debian:12) | < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| debian/clamav(Debian:13) | < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| debian/clamav(Debian:14) | < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| cat quick heal | = 11.00 | No fix listed |
| clamav | = 0.96.4 | No fix listed |
References
- Debian Security Tracker CVE-2012-1419 vendor-advisory
- 80409 vdb-entry
- www.ieee-security.org
- 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products mailing-list
- 52572 vdb-entry
- bugs.debian.org issue-tracking