VAR-201203-0371

Vulnerability from variot - Updated: 2023-12-18 12:10

The ELF file parser in Fortinet Antivirus 4.2.254.0, eSafe 7.0.17.0, Dr.Web 5.0.2.03300, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified e_version field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. Successful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection. The following products are affected: DrWeb Antivirus 5.0.2.03300 Panda Antivirus 10.0.2.7. Fortinet Antivirus is an antivirus software designed by Fortinet Company using signature database and heuristic scanning engine

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201203-0371",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "esafe",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "aladdin",
        "version": "7.0.17.0"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "fortinet",
        "version": "4.2.254.0"
      },
      {
        "model": "panda antivirus",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "pandasecurity",
        "version": "10.0.2.7"
      },
      {
        "model": "dr.web antivirus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "drweb",
        "version": "5.0.2.03300"
      },
      {
        "model": "dr.web anti-virus",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "doctor web",
        "version": "5.0.2.03300"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "panda security",
        "version": "10.0.2.7"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "panda",
        "version": "10.0.27"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "drweb",
        "version": "5.0.203300"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "52601"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortinet_antivirus:4.2.254.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:drweb:dr.web_antivirus:5.0.2.03300:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:pandasecurity:panda_antivirus:10.0.2.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Suman Jana and Vitaly Shmatikov",
    "sources": [
      {
        "db": "BID",
        "id": "52601"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2012-1447",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2012-1447",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-54728",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-1447",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201203-411",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-54728",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The ELF file parser in Fortinet Antivirus 4.2.254.0, eSafe 7.0.17.0, Dr.Web 5.0.2.03300, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified e_version field.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. \nSuccessful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection. \nThe following products are affected:\nDrWeb Antivirus 5.0.2.03300\nPanda Antivirus 10.0.2.7. Fortinet Antivirus is an antivirus software designed by Fortinet Company using signature database and heuristic scanning engine",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "BID",
        "id": "52601"
      },
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-1447",
        "trust": 2.8
      },
      {
        "db": "BID",
        "id": "52601",
        "trust": 1.4
      },
      {
        "db": "OSVDB",
        "id": "80432",
        "trust": 1.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411",
        "trust": 0.7
      },
      {
        "db": "NSFOCUS",
        "id": "19233",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20120319 EVASION ATTACKS EXPOLITING FILE-PARSING VULNERABILITIES IN ANTIVIRUS PRODUCTS",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-54728",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "db": "BID",
        "id": "52601"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "id": "VAR-201203-0371",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:10:12.769000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.drweb.co.jp/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.fortinet.com/solutions/antivirus.html"
      },
      {
        "title": "Panda Antivirus",
        "trust": 0.8,
        "url": "http://www.ps-japan.co.jp/"
      },
      {
        "title": "eSafe",
        "trust": 0.8,
        "url": "http://www.aladdin.co.jp/esafe/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/archive/1/522005"
      },
      {
        "trust": 1.7,
        "url": "http://www.ieee-security.org/tc/sp2012/program.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/52601"
      },
      {
        "trust": 1.1,
        "url": "http://osvdb.org/80432"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1447"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1447"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/19233"
      },
      {
        "trust": 0.3,
        "url": "http://http://www.freedrweb.com/cureit/?lng=en"
      },
      {
        "trust": 0.3,
        "url": "http://www.pandasecurity.com/usa/"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/522005"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "db": "BID",
        "id": "52601"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "db": "BID",
        "id": "52601"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-03-21T00:00:00",
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "date": "2012-03-20T00:00:00",
        "db": "BID",
        "id": "52601"
      },
      {
        "date": "2012-03-23T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "date": "2012-03-21T10:11:48.333000",
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "date": "2012-03-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-12-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-54728"
      },
      {
        "date": "2012-03-20T00:00:00",
        "db": "BID",
        "id": "52601"
      },
      {
        "date": "2012-04-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      },
      {
        "date": "2017-12-06T02:29:04.650000",
        "db": "NVD",
        "id": "CVE-2012-1447"
      },
      {
        "date": "2012-03-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple products  ELF Vulnerability that prevents file parsers from detecting malware",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001879"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-411"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.