var-201203-0147
Vulnerability from variot
The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations. Multiple products ZIP A file parser contains a vulnerability that can prevent malware detection. Different ZIP Parser If it is announced that there is also a problem with the implementation of CVE May be split.A third party includes an invalid block of data at the beginning ZIP Malware detection may be avoided via files. Successful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201203-0147", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "anti-virus", "scope": "eq", "trust": 1.8, "vendor": "avg", "version": "10.0.0.1190" }, { "model": "anti-malware", "scope": "eq", "trust": 1.8, "vendor": "emsisoft", "version": "5.1.0.1" }, { "model": "virus utilities t3 command line scanner", "scope": "eq", "trust": 1.8, "vendor": "ikarus", "version": "1.1.97.0" }, { "model": "antivirus", "scope": "eq", "trust": 1.8, "vendor": "jiangmin", "version": "13.0.900" }, { "model": "esafe", "scope": "eq", "trust": 1.8, "vendor": "aladdin", "version": "7.0.17.0" }, { "model": "anti-virus", "scope": "eq", "trust": 1.8, "vendor": "kaspersky", "version": "7.0.0.125" }, { "model": "antivirus", "scope": "eq", "trust": 1.8, "vendor": "fortinet", "version": "4.2.254.0" }, { "model": "endpoint protection", "scope": "eq", "trust": 1.6, "vendor": "symantec", "version": "11.0" }, { "model": "v3 internet security", "scope": "eq", "trust": 1.0, "vendor": "ahnlab", "version": "2011.01.18.00" }, { "model": "quick heal", "scope": "eq", "trust": 1.0, "vendor": "cat", "version": "11.00" }, { "model": "antivirus", "scope": "eq", "trust": 0.8, "vendor": "norman", "version": "6.06.12" }, { "model": "v3 internet security", "scope": "eq", "trust": 0.8, "vendor": "unlab", "version": "2011.01.18.00" }, { "model": "heal", "scope": "eq", "trust": 0.8, "vendor": "quick heal k k", "version": "11.00" }, { "model": "endpoint protection", "scope": "eq", "trust": 0.8, "vendor": "symantec", "version": "11" }, { "model": "anti-virus", "scope": "eq", "trust": 0.8, "vendor": "sophos", "version": "4.61.0" }, { "model": "antivirus", "scope": "eq", "trust": 0.3, "vendor": "symantec", "version": "20101.3103" }, { "model": "anti-virus", "scope": "eq", "trust": 0.3, "vendor": "sophos", "version": "4.61" }, { "model": "cat-quickheal", "scope": "eq", "trust": 0.3, "vendor": "quick heal", "version": "11.00" }, { "model": "antivirus", "scope": "eq", "trust": 0.3, "vendor": "norman", "version": "6.6.12" }, { "model": "antivirus", "scope": "eq", "trust": 0.3, "vendor": "kaspersky", "version": "7.0125" }, { "model": "jiangmin", "scope": "eq", "trust": 0.3, "vendor": "jiangmin", "version": "13.0.900" }, { "model": "antivirus t3.1.1.97.0", "scope": null, "trust": 0.3, "vendor": "ikarus", "version": null }, { "model": "antivirus", "scope": "eq", "trust": 0.3, "vendor": "fortinet", "version": "4.2.2540" }, { "model": "antivirus", "scope": "eq", "trust": 0.3, "vendor": "esafe", "version": "7.0.170" }, { "model": "antivirus", "scope": "eq", "trust": 0.3, "vendor": "emsisoft", "version": "5.11" }, { "model": "anti-virus", "scope": "eq", "trust": 0.3, "vendor": "avg", "version": "10.01190" }, { "model": "engine", "scope": "eq", "trust": 0.3, "vendor": "ahnlab", "version": "v32011.01.18.00" } ], "sources": [ { "db": "BID", "id": "52613" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "NVD", "id": "CVE-2012-1462" }, { "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ikarus:ikarus_virus_utilities_t3_command_line_scanner:1.1.97.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:jiangmin:jiangmin_antivirus:13.0.900:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:kaspersky:kaspersky_anti-virus:7.0.0.125:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ahnlab:v3_internet_security:2011.01.18.00:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:avg:avg_anti-virus:10.0.0.1190:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:symantec:endpoint_protection:11.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:emsisoft:anti-malware:5.1.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2012-1462" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Suman Jana and Vitaly Shmatikov", "sources": [ { "db": "BID", "id": "52613" } ], "trust": 0.3 }, "cve": "CVE-2012-1462", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "exploitabilityScore": 8.6, "impactScore": 2.9, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 4.3, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2012-1462", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "exploitabilityScore": 8.6, "id": "VHN-54743", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2012-1462", "trust": 1.8, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201203-425", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-54743", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-54743" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "NVD", "id": "CVE-2012-1462" }, { "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations. Multiple products ZIP A file parser contains a vulnerability that can prevent malware detection. Different ZIP Parser If it is announced that there is also a problem with the implementation of CVE May be split.A third party includes an invalid block of data at the beginning ZIP Malware detection may be avoided via files. \nSuccessful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection", "sources": [ { "db": "NVD", "id": "CVE-2012-1462" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "BID", "id": "52613" }, { "db": "VULHUB", "id": "VHN-54743" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2012-1462", "trust": 2.8 }, { "db": "BID", "id": "52613", "trust": 1.4 }, { "db": "JVNDB", "id": "JVNDB-2012-001871", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201203-425", "trust": 0.7 }, { "db": "BUGTRAQ", "id": "20120319 EVASION ATTACKS EXPOLITING FILE-PARSING VULNERABILITIES IN ANTIVIRUS PRODUCTS", "trust": 0.6 }, { "db": "NSFOCUS", "id": "19217", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-54743", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-54743" }, { "db": "BID", "id": "52613" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "NVD", "id": "CVE-2012-1462" }, { "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "id": "VAR-201203-0147", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-54743" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T12:10:08.311000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "AVG Anti-Virus", "trust": 0.8, "url": "http://www.avgjapan.com/home-small-office-security/buy-antivirus" }, { "title": "Emsisoft Anti-Malware", "trust": 0.8, "url": "http://www.emsisoft.com/en/software/antimalware/" }, { "title": "Fortinet Antivirus", "trust": 0.8, "url": "http://www.fortinet.com/solutions/antivirus.html" }, { "title": "Top Page", "trust": 0.8, "url": "http://www.ikarus.at/en/" }, { "title": "Jiangmin Antivirus", "trust": 0.8, "url": "http://global.jiangmin.com/" }, { "title": "Top Page", "trust": 0.8, "url": "http://www.norman.com/" }, { "title": "Quick Heal", "trust": 0.8, "url": "http://www.quickheal.com/" }, { "title": "Endpoint Protection", "trust": 0.8, "url": "http://www.symantec.com/ja/jp/endpoint-protection" }, { "title": "eSafe", "trust": 0.8, "url": "http://www.aladdin.co.jp/esafe/" }, { "title": "V3 Internet Security", "trust": 0.8, "url": "http://www.ahnlab.co.jp/product_service/product/b2b/v3is8.asp" }, { "title": "Kaspersky Anti-Virus", "trust": 0.8, "url": "http://www.kaspersky.com/kaspersky_anti-virus" }, { "title": "Top Page", "trust": 0.8, "url": "http://www.sophos.com" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2012-001871" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-264", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-54743" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "NVD", "id": "CVE-2012-1462" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://www.securityfocus.com/archive/1/522005" }, { "trust": 1.7, "url": "http://www.ieee-security.org/tc/sp2012/program.html" }, { "trust": 1.1, "url": "http://www.securityfocus.com/bid/52613" }, { "trust": 1.1, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74310" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1462" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1462" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/19217" }, { "trust": 0.3, "url": "http://www.ahnlab.com" }, { "trust": 0.3, "url": "http://www.avg.com" }, { "trust": 0.3, "url": "http://www.emsisoft.com/en/software/antimalware/" }, { "trust": 0.3, "url": "http://www.safenet-inc.com/data-protection/content-security-esafe/" }, { "trust": 0.3, "url": "http://www.fortinet.com/" }, { "trust": 0.3, "url": "http://www.ikarus.at" }, { "trust": 0.3, "url": "http://global.jiangmin.com/" }, { "trust": 0.3, "url": "http://www.kaspersky.com/" }, { "trust": 0.3, "url": "http://anti-virus-software-review.toptenreviews.com/norman-review.html" }, { "trust": 0.3, "url": "http://www.quickheal.com/" }, { "trust": 0.3, "url": "http://www.sophos.com/" }, { "trust": 0.3, "url": "http://www.symantec.com" }, { "trust": 0.3, "url": "/archive/1/522005" } ], "sources": [ { "db": "VULHUB", "id": "VHN-54743" }, { "db": "BID", "id": "52613" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "NVD", "id": "CVE-2012-1462" }, { "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-54743" }, { "db": "BID", "id": "52613" }, { "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "db": "NVD", "id": "CVE-2012-1462" }, { "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2012-03-21T00:00:00", "db": "VULHUB", "id": "VHN-54743" }, { "date": "2012-03-20T00:00:00", "db": "BID", "id": "52613" }, { "date": "2012-03-23T00:00:00", "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "date": "2012-03-21T10:11:49.707000", "db": "NVD", "id": "CVE-2012-1462" }, { "date": "2012-03-26T00:00:00", "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-08-29T00:00:00", "db": "VULHUB", "id": "VHN-54743" }, { "date": "2012-03-20T00:00:00", "db": "BID", "id": "52613" }, { "date": "2012-03-23T00:00:00", "db": "JVNDB", "id": "JVNDB-2012-001871" }, { "date": "2017-08-29T01:31:17.383000", "db": "NVD", "id": "CVE-2012-1462" }, { "date": "2012-03-26T00:00:00", "db": "CNNVD", "id": "CNNVD-201203-425" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201203-425" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Multiple products ZIP Vulnerability that prevents file parsers from detecting malware", "sources": [ { "db": "JVNDB", "id": "JVNDB-2012-001871" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control", "sources": [ { "db": "CNNVD", "id": "CNNVD-201203-425" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.