CVE-2012-1457 The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.0...
- Published
- Updated
- Exploit status
- No public exploit known
Description
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/clamav(Debian:12) | < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| debian/clamav(Debian:13) | < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| debian/clamav(Debian:14) | < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| aladdin esafe | = 7.0.17.0 | No fix listed |
| alwil avast antivirus | = 4.8.1351.0 | No fix listed |
| alwil avast antivirus | = 5.0.677.0 | No fix listed |
| anti-virus vba32 | = 3.12.14.2 | No fix listed |
| antiy avl sdk | = 2.0.3.7 | No fix listed |
| authentium command antivirus | = 5.2.11.5 | No fix listed |
| avg anti-virus | = 10.0.0.1190 | No fix listed |
| avira antivir | = 7.11.1.163 | No fix listed |
| bitdefender | = 7.2 | No fix listed |
| cat quick heal | = 11.00 | No fix listed |
| clamav | = 0.96.4 | No fix listed |
| emsisoft anti-malware | = 5.1.0.1 | No fix listed |
| eset nod32 antivirus | = 5795 | No fix listed |
| f-prot antivirus | = 4.6.2.117 | No fix listed |
| gdata-software g data antivirus | = 21 | No fix listed |
| ikarus virus utilities t3 command line scanner | = 1.1.97.0 | No fix listed |
| jiangmin antivirus | = 13.0.900 | No fix listed |
| k7computing antivirus | = 9.77.3565 | No fix listed |
| kaspersky anti-virus | = 7.0.0.125 | No fix listed |
| mcafee gateway | = 2010.1c | No fix listed |
| mcafee scan engine | = 5.400.0.1158 | No fix listed |
| Microsoft security essentials | = 2.0 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| norman antivirus antispyware | = 6.06.12 | No fix listed |
| pc tools antivirus | = 7.0.3.5 | No fix listed |
| rising-global rising antivirus | = 22.83.00.03 | No fix listed |
| symantec endpoint protection | = 11.0 | No fix listed |
| trendmicro housecall | = 9.120.0.1004 | No fix listed |
| trendmicro trend micro antivirus | = 9.120.0.1004 | No fix listed |
| virusbuster | = 13.6.151.0 | No fix listed |
References
- Debian Security Tracker CVE-2012-1457 vendor-advisory
- openSUSE-SU-2012:0833 vendor-advisory
- 80389 vdb-entry
- 80391 vdb-entry
- 80392 vdb-entry
- 80393 vdb-entry
- 80395 vdb-entry
- 80396 vdb-entry
- 80403 vdb-entry
- 80406 vdb-entry
- 80407 vdb-entry
- 80409 vdb-entry
- www.ieee-security.org
- MDVSA-2012:094 vendor-advisory
- 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products mailing-list
- 52610 vdb-entry
- multiple-av-tar-length-evasion(74293) vdb-entry
- bugs.debian.org issue-tracking