var-201203-0391
Vulnerability from variot

The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. Multiple products ELF A file parser contains a vulnerability that can prevent malware detection. Different ELF If it is announced that there is also a problem with the parser implementation, this vulnerability can be CVE May be split.A specific position by a third party \4a\46\49\46 With the character sequence ELF Malware detection may be avoided via files. Successful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection. Multiple file-parsing vulnerabilities leading to evasion in different antivirus(AV) products. All affected products are command-line versions of the AVs.

Vulnerability Descriptions

  1. Specially crafted infected POSIX TAR files with "[aliases]" as first 9 bytes evades detection.

Affected products - ClamAV 0.96.4, CAT-QuickHeal 11.00

CVE no - CVE-2012-1419

  1. Specially crafted infected POSIX TAR files with "\7fELF" as first 4 bytes evades detection.

Affected products - CAT-QuickHeal 11.00, Command 5.2.11.5, F-Prot 4.6.2.117, Fortinent 4.2.254.0, K7AntiVirus 9.77.3565, Kaspersky 7.0.0.125, Microsoft 1.6402, NOD32 5795, Norman 6.06.12, Panda 10.0.2.7, Rising 22.83.00.03

CVE no - CVE-2012-1420

  1. Specially crafted infected POSIX TAR files with "MSCF" as first 4 bytes evades detection.

Affected products - CAT-QuickHeal 11.00, Norman 6.06.12, Rising 22.83.00.03, Symantec 20101.3.0.103

CVE no - CVE-2012-1421

  1. Specially crafted infected POSIX TAR files with "ITSF" as first 4 bytes evades detection.

Affected products - CAT-QuickHeal 11.00, NOD32 5795, Norman 6.06.12, Rising 22.83.00.03

CVE no - CVE-2012-1422

  1. Specially crafted infected POSIX TAR files with "MZ" as first 2 bytes evades detection.

Affected products - Command 5.2.11.5, Emsisoft 5.1.0.1, F-Prot 4.6.2.117, Fortinent 4.2.254.0, Ikarus T3.1.1.97.0, K7AntiVirus 9.77.3565, NOD32 5795, Norman 6.06.12, PCTools 7.0.3.5, Rising 22.83.00.03, VirusBuster 13.6.151.0

CVE no - CVE-2012-1423

  1. Specially crafted infected POSIX TAR files with "\19\04\00\10" at offset 8 evades detection.

Affected products - Antiy-AVL 2.0.3.7, CAT-QuickHeal 11.00, Jiangmin 13.0.900, Norman 6.06.12, PCTools 7.0.3.5, Sophos 4.61.0

CVE no - CVE-2012-1424

  1. Specially crafted infected POSIX TAR files with "\50\4B\03\04" as the first 4 bytes evades detection.

Affected products - AntiVir 7.11.1.163, Antiy-AVL 2.0.3.7, CAT-QuickHeal 11.00, Emsisoft 5.1.0.1, Fortinet 4.2.254.0, Ikarus T3.1.1.97.0, Jiangmin 13.0.900, Kaspersky 7.0.0.125, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, NOD32 5795, Norman 6.06.12, PCTools 7.0.3.5, Symantec 20101.3.0.103, TrendMicro 9.120.0.1004, TrendMicro-HouseCall 9.120.0.1004

CVE no - CVE-2012-1425

  1. Specially crafted infected POSIX TAR files with "\42\5A\68" as the first 3 bytes evades detection.

Affected products - CAT-QuickHeal 11.00, Command 5.2.11.5, F-Prot 4.6.2.117, K7AntiVirus 9.77.3565, Norman 6.06.12, Rising 22.83.00.03

CVE no - CVE-2012-1426

  1. Specially crafted infected POSIX TAR files with "\57\69\6E\5A\69\70" at offset 29 evades detection.

Affected products - CAT-QuickHeal 11.00, Norman 6.06.12, Sophos 4.61.0

CVE no - CVE-2012-1427

  1. Specially crafted infected POSIX TAR files with "\4a\46\49\46" at offset 6 evades detection.

Affected products - CAT-QuickHeal 11.00, Norman 6.06.12, Sophos 4.61.0

CVE no - CVE-2012-1428

  1. Specially crafted infected ELF files with "ustar" at offset 257 evades detection.

Affected products - BitDefender 7.2, Comodo 7424, Emsisoft 5.1.0.1, eSafe 7.0.17.0, F-Secure 9.0.16160.0, Ikarus T3.1.1.97.0, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, nProtect 2011-01-17.01

CVE no - CVE-2012-1429 12. Specially crafted infected ELF files with "\19\04\00\10" at offset 8 evades detection. Specially crafted infected ELF files with "\4a\46\49\46" at offset 6 evades detection.

Affected products - BitDefender 7.2, Command 5.2.11.5, Comodo 7424, eSafe 7.0.17.0, F-Prot 4.6.2.117, F-Secure 9.0.16160.0, McAfee-GW-Edition 2010.1C, nProtect 2011-01-17.01, Sophos 4.61.0, Rising 22.83.00.03

CVE no - CVE-2012-1431

  1. Specially crafted infected MS EXE files with "\57\69\6E\5A\69\70" at offset 29 evades detection.

Affected products - Emsisoft 5.1.0.1, eSafe 7.0.17.0, Ikarus T3.1.1.97.0, Panda 10.0.2.7

CVE no - CVE-2012-1432

  1. Specially crafted infected MS EXE files with "\4a\46\49\46" at offset 6 evades detection.

Affected products - AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, Ikarus T3.1.1.97.0, Panda 10.0.2.7

CVE no - CVE-2012-1433

  1. Specially crafted infected MS EXE files with "\19\04\00\10" at offset 8 evades detection.

Affected products - AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, Ikarus T3.1.1.97.0, Panda 10.0.2.7

CVE no - CVE-2012-1434

  1. Specially crafted infected MS EXE files with "\50\4B\4C\49\54\45" at offset 30 evades detection.

Affected products - AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, Ikarus T3.1.1.97.0, Panda 10.0.2.7

CVE no - CVE-2012-1435

  1. Specially crafted infected MS EXE files with "\2D\6C\68" at offset 2 evades detection.

Affected products - AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, Ikarus T3.1.1.97.0, Panda 10.0.2.7

CVE no - CVE-2012-1436

  1. Specially crafted infected MS Office files with "\50\4B\53\70\58" at offset 526 evades detection.

Affected products - Comodo 7425

CVE no - CVE-2012-1437

  1. Specially crafted infected MS Office files with "ustar" at offset 257 evades detection.

Affected products - Comodo 7425, Sophos 4.61.0

CVE no - CVE-2012-1438

  1. 'padding' field in ELF files is parsed incorrectly. If an infected ELF file's padding field is incremented by 1 it evades detection.

Affected products - eSafe 7.0.17.0, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1439

  1. 'identsize' field in ELF files is parsed incorrectly. If an infected ELF file's identsize field is incremented by 1 it evades detection.

Affected products - Norman 6.06.12, eSafe 7.0.17.0, eTrust-Vet 36.1.8511, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1440

  1. 'e_ip' and 'e_res' field in MS EXE files are parsed incorrectly.
    If any of these fields in an infected MS EXE file is incremented by 1 it evades detection.

Affected products - Prevx 3.0

'e_minalloc', 'e_res2','e_cparhdr', 'e_crlc', 'e_lfarlc','e_maxalloc', 'e_oeminfo', 'e_ovno', 'e_cs', 'e_csum','e_sp', 'e_ss', 'e_cblp' and 'e_oemid' fields in MS EXE files are parsed incorrectly.
If any of these fields in an infected MS EXE file is incremented by 1 it evades detection.

Affected products - eSafe 7.0.017.0, Prevx 3.0

CVE no - CVE-2012-1441

  1. 'class' field in ELF files is parsed incorrectly.
    If an infected ELF file's class field is incremented by 1 it evades detection.

Affected products - CAT-QuickHeal 11.00, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, eSafe 7.0.017.0, Kaspersky 7.0.0.125, F-Secure 9.0.16160.0, Sophos 4.61.0, Antiy-AVL 2.0.3.7, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1442

  1. Infected RAR files with initial two bytes set to 'MZ' can be fixed by the user and correctly extracted. Such a file evades detection.

Affected products - ClamAV 0.96.4, Rising 22.83.00.03, CAT-QuickHeal 11.00, GData 21, Symantec 20101.3.0.103, Command 5.2.11.5, Ikarus T3.1.1.97.0, Emsisoft 5.1.0.1, PCTools 7.0.3.5, F-Prot 4.6.2.117, VirusBuster 13.6.151.0, Fortinent 4.2.254.0, Antiy-AVL 2.0.3.7, K7AntiVirus 9.77.3565, TrendMicro-HouseCall 9.120.0.1004,Kaspersky 7.0.0.125 Jiangmin 13.0.900. Microsoft 1.6402, Sophos 4.61.0, NOD32 5795, AntiVir 7.11.1.163, Norman 6.06.12, McAfee 5.400.0.1158, Panda 10.0.2.7, McAfee-GW-Edition 2010.1C, TrendMicro 9.120.0.1004, Comodo 7424, BitDefender 7.2, eSafe 7.0.17.0, F-Secure 9.0.16160.0 nProtect 2011-01-17.01, AhnLab-V3 2011.01.18.00, AVG 10.0.0.1190, Avast 4.8.1351.0, Avast5 5.0.677.0, VBA32 3.12.14.2

CVE no - CVE-2012-1443

  1. 'abiversion' field in ELF files is parsed incorrectly.
    If an infected ELF file's abiversion field is incremented by 1 it evades detection.

Affected products - eSafe 7.0.017.0, Prevx 3.0, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1444

  1. 'abi' field in ELF files is parsed incorrectly.
    If an infected ELF file's abi field is incremented by 1 it evades detection.

Affected products - eSafe 7.0.017.0, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1445

  1. 'encoding' field in ELF files is parsed incorrectly.
    If an infected ELF file's encoding field is incremented by 1 it evades detection.

Affected products - CAT-QuickHeal 11.00, McAfee 5.400.0.1158, Symantec 20101.3.0.103, Norman 6.06.12, eSafe 7.0.017.0, Kaspersky 7.0.0.125, McAfee-GW-Edition 2010.1C, Sophos 4.61.0, eTrust-Vet 36.1.8511, Antiy-AVL 2.0.3.7, PCTools 7.0.3.5, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1446

  1. 'e_version' field in ELF files is parsed incorrectly.
    If an infected ELF file's e_version field is incremented by 1 it evades detection.

Affected products - Fortinet 4.2.254.0, eSafe 7.0.017.0, DrWeb 5.0.2.03300, Panda 10.0.2.7

CVE no - CVE-2012-1447

  1. 'cbCabinet' field in CAB files is parsed incorrectly.
    If an infected CAB file's cbCabinet field is incremented by 1 it evades detection.

Affected products - CAT-QuickHeal 11.00, TrendMicro 9.120.0.1004, Ikarus T3.1.1.97.0 TrendMicro-HouseCall 9.120.0.1004, Emsisoft 5.1.0.1

CVE no - CVE-2012-1448

  1. 'vMajor' field in CAB files is parsed incorrectly.
    If an infected CAB file's vMajor field is incremented by 1 it evades detection.

Affected products - NOD32 5795, Rising 22.83.00.03

CVE no - CVE-2012-1449

  1. 'reserved3' field in CAB files is parsed incorrectly.
    If an infected CAB file's reserved field is incremented by 1 it evades detection.

Affected products - Emsisoft 5.1.0.1, Sophos 4.61.0, Ikarus T3.1.1.97.0

CVE no - CVE-2012-1450

  1. 'reserved2' field in CAB files is parsed incorrectly.
    If an infected CAB file's reserved2 field is incremented by 1 it evades detection.

Affected products - Emsisoft 5.1.0.1, Ikarus T3.1.1.97.0

CVE no - CVE-2012-1451

  1. 'reserved1' field in CAB files is parsed incorrectly.
    If an infected CAB file's reserved field is incremented by 1 it evades detection.

Affected products - Emsisoft 5.1.0.1, Ikarus T3.1.1.97.0, CAT-QuickHeal 11.00

CVE no - CVE-2012-1452

  1. 'coffFiles' field in CAB files is parsed incorrectly.
    If an infected CAB file's coffFiles field is incremented by 1 it evades detection.

Affected products - McAfee 5.0.2.03300, TrendMicro-HouseCall 9.120.0.1004, Kaspersky 7.0.0.125, Sophos 4.61.0, TrendMicro 9.120.0.1004, McAfee-GW-Edition 2010.1C, Emsisoft 5.1.0.1, eTrust-Vet 36.1.8511, Antiy-AVL 2.0.3.7, Microsoft 1.6402, Rising 22.83.00.03, Ikarus T3.1.1.97.0, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1453

  1. 'ei_version' field in ELF files is parsed incorrectly.
    If an infected ELF file's version field is incremented by 1 it evades detection.

Affected products - McAfee 5.0.02.03300, eSafe 7.0.17.0, McAfee-GW-Edition 2010.1C, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7

CVE no - CVE-2012-1454

  1. 'vMinor' field in CAB files is parsed incorrectly.
    If an infected CAB file's version field is incremented by 1 it evades detection.

Affected products - NOD32 5795, Rising 22.83.00.03

CVE no - CVE-2012-1455

  1. A specially crafted ZIP file, created by concatenating the contents of a clean TAR archive and a virus-infected ZIP archive, is parsed incorrectly and evades detection. If the length field in the header of a file with test EICAR virus included into a TAR archive is set to be greater than the archive's total length (1,000,000+original length in our experiments), the antivirus declares the file to be clean but virus gets extracted correctly by the GNU tar program.

Affected products - AntiVir 7.11.1.163, Antiy-AVL 2.0.3.7, Avast 4.8.1351.0, Avast5 5.0.677.0, AVG 10.0.0.1190, BitDefender 7.2, CAT-QuickHeal 11.00, ClamAV 0.96.4, Command 5.2.11.5, Emsisoft 5.1.0.1, eSafe 7.0.17.0, F-Prot 4.6.2.117, GData 21, Ikarus T3.1.1.97.0, Jiangmin 13.0.900, K7AntiVirus 9.77.3565, Kaspersky 7.0.0.125, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, Microsoft 1.6402, NOD32 5795, Norman 6.06.12, PCTools 7.0.3.5, Rising 22.83.00.03, Symantec 20101.3.0.103, TrendMicro 9.120.0.1004, TrendMicro-HouseCall 9.120.0.1004, VBA32 3.12.14.2, VirusBuster 13.6.151.0

CVE no - CVE-2012-1457

  1. A Windows Compiled HTML Help (CHM) file is a set of HTML files, scripts, and images compressed using the LZX algorithm. For faster random accesses, the algorithm is reset at intervals instead of compressing the entire file as a single stream. The length of each interval is specified in the LZXC header.

If an infected CHM file's header modified so that the reset interval is lower than in the original file, the antivirus declares the file to be clean. But the Windows CHM viewer hh.exe correctly decompresses the infected content located before the tampered header.

Affected products - ClamAV 0.96.4, Sophos 4.61.0

CVE no - CVE-2012-1458

  1. In a POSIX TAR archive, each member file has a 512-byte header protected by a simple checksum. Every header also contains a file length field, which is used by the extractor to locate the next header in the archive.

If a TAR archive contains two files: the first one is clean, while the second is infected with test EICAR virus - and it is modified such that the length field in the header of the first, clean file to point into the middle of the header of the second, infected file. The antivirus declares the file to be clean but virus gets extracted correctly by the GNU tar program. If an infected tar.gz archive is appended 6 random bytes at the end, the antivirus declares the file to be clean but virus gets extracted by the gunzip+tar programs correctly by ignoring these bytes.

Affected products - Antiy-AVL 2.0.3.7, CAT-QuickHeal 11.00, Command 5.2.11.5, eSafe 7.0.17.0, F-Prot 4.6.2.117, Jiangmin 13.0.900, K7AntiVirus 9.77.3565, VBA32 3.12.14.2

CVE no - CVE-2012-1460

  1. GZIP files can contain multiple compressed streams, which are assembled when the contents are extracted. If an infected .tar.gz file is broken into two streams, the antivirus declares the infected .tar.gz file to be clean while tar+gunzip extract the virus correctly

Affected products - AVG 10.0.0.1190, BitDefender 7.2, Command 5.2.11.5, Emsisoft 5.1.0.1, F-Secure 9.0.16160.0, Fortinent 4.2.254.0, Ikarus T3.1.1.97.0, Jiangmin 13.0.900, K7AntiVirus 9.77.3565, Kaspersky 7.0.0.125, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, NOD32 5795, Norman 6.06.12, Rising 22.83.00.03, Sophos 4.61.0, Symantec 20101.3.0.103, TrendMicro 9.120.0.1004, TrendMicro-HouseCall 9.120.0.1004, VBA32 3.12.14.2

CVE no - CVE-2012-1461

  1. If an infected ZIP archive is prepended with 1024 random bytes at the beginning, the antivirus declares the file to be clean but virus gets extracted by the unzip program correctly by skipping these bytes

Affected products - AhnLab-V3 2011.01.18.00, AVG 10.0.0.1190, CAT-QuickHeal 11.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, Fortinent 4.2.254.0, Ikarus T3.1.1.97.0, Jiangmin 13.0.900, Kaspersky 7.0.0.125, Norman 6.06.12, Sophos 4.61.0, Symantec 20101.3.0.103

CVE no - CVE-2012-1462

  1. In most ELF files, the 5th byte of the header indicates endianness: 01 for little-endian, 02 for bigendian. Linux kernel, however, does not check this field before loading an ELF file. If an infected ELF file's 5-th byte is set to 02, the antivirus declares the file to be clean but the ELF file gets executed correctly.

Affected products - AhnLab-V3 2011.01.18.00, BitDefender 7.2, CAT-QuickHeal 11.00, Command 5.2.11.5, Comodo 7424, eSafe 7.0.17.0, F-Prot 4.6.2.117, F-Secure 9.0.16160.0, McAfee 5.400.0.1158, Norman 6.06.12, nProtect 2011-01-17.01, Panda 10.0.2.7

CVE no - CVE-2012-1463

Credits

Vulnerabilities found and advisory written by Suman Jana and Vitaly Shmatikov.

References

"Abusing File Processing in Malware Detectors for Fun and Profit" by Suman Jana and Vitaly Shmatikov To appear in IEEE Symposium on Security and Privacy 2012 http://www.ieee-security.org/TC/SP2012/

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201203-0391",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 2.1,
        "vendor": "comodo",
        "version": "7424"
      },
      {
        "model": "command antivirus",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "authentium",
        "version": "5.2.11.5"
      },
      {
        "model": "bitdefender",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "bitdefender",
        "version": "7.2"
      },
      {
        "model": "esafe",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "aladdin",
        "version": "7.0.17.0"
      },
      {
        "model": "f-secure anti-virus",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "f secure",
        "version": "9.0.16160.0"
      },
      {
        "model": "anti-virus",
        "scope": "eq",
        "trust": 1.8,
        "vendor": "sophos",
        "version": "4.61.0"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "rising global",
        "version": "22.83.00.03"
      },
      {
        "model": "f-prot antivirus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "f prot",
        "version": "4.6.2.117"
      },
      {
        "model": "gateway",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "mcafee",
        "version": "2010.1c"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "nprotect",
        "version": "2011-01-17.01"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "rising",
        "version": "22.83.00.03"
      },
      {
        "model": "f-prot antivirus",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "frisk",
        "version": "4.6.2.117"
      },
      {
        "model": "anti-virus",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nprotect",
        "version": "2011-01-17.01"
      },
      {
        "model": "web gateway software",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "mcafee",
        "version": "2010.1c"
      },
      {
        "model": "anti-virus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sophos",
        "version": "4.61"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rising",
        "version": "22.8303"
      },
      {
        "model": "mcafee-gw-edition 2010.1c",
        "scope": null,
        "trust": 0.3,
        "vendor": "mcafee",
        "version": null
      },
      {
        "model": "nprotect",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "inca",
        "version": "2011-01-17.01"
      },
      {
        "model": "software f-prot antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "frisk",
        "version": "4.6.2117"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "f secure",
        "version": "9.0.16160.0"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "esafe",
        "version": "7.0.170"
      },
      {
        "model": "antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "bitdefender",
        "version": "7.2"
      },
      {
        "model": "command antivirus",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "authentium",
        "version": "5.2.115"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "52591"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:comodo:comodo_antivirus:7424:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:9.0.16160.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mcafee:gateway:2010.1c:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:nprotect:nprotect_antivirus:2011-01-17.01:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sophos:sophos_anti-virus:4.61.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:bitdefender:bitdefender:7.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:aladdin:esafe:7.0.17.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Suman Jana and Vitaly Shmatikov",
    "sources": [
      {
        "db": "BID",
        "id": "52591"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2012-1431",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2012-1431",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-54712",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-1431",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201203-396",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-54712",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \\4a\\46\\49\\46 character sequence at a certain location.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. Multiple products ELF A file parser contains a vulnerability that can prevent malware detection. Different ELF If it is announced that there is also a problem with the parser implementation, this vulnerability can be CVE May be split.A specific position by a third party \\4a\\46\\49\\46 With the character sequence ELF Malware detection may be avoided via files. \nSuccessful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection. Multiple file-parsing vulnerabilities leading to evasion in different antivirus(AV) products. All \naffected products are command-line versions of \nthe AVs. \n\n----------------------------\nVulnerability Descriptions\n----------------------------\n\n1. Specially crafted infected POSIX TAR files with \"[aliases]\" as first 9 bytes \n   evades detection. \n\n   Affected products -\n   ClamAV 0.96.4, CAT-QuickHeal 11.00\n  \n   CVE no - \n   CVE-2012-1419\n\n2. Specially crafted infected POSIX TAR files with \"\\7fELF\" as first 4 bytes \n   evades detection. \n\n   Affected products -\n   CAT-QuickHeal 11.00, Command 5.2.11.5, F-Prot 4.6.2.117, \n   Fortinent 4.2.254.0, K7AntiVirus 9.77.3565, Kaspersky 7.0.0.125, \n   Microsoft 1.6402, NOD32 5795, Norman 6.06.12, Panda 10.0.2.7, \n   Rising 22.83.00.03\n\n   CVE no - \n   CVE-2012-1420\n\n3. Specially crafted infected POSIX TAR files with \"MSCF\" as first 4 bytes \n   evades detection. \n\n   Affected products -\n   CAT-QuickHeal 11.00, Norman 6.06.12, Rising 22.83.00.03, \n   Symantec 20101.3.0.103\n\n   CVE no - \n   CVE-2012-1421\n\n4. Specially crafted infected POSIX TAR files with \"ITSF\" as first 4 bytes \n   evades detection. \n\n   Affected products -\n   CAT-QuickHeal 11.00, NOD32 5795, Norman 6.06.12, Rising 22.83.00.03\n\n   CVE no - \n   CVE-2012-1422\n\n5. Specially crafted infected POSIX TAR files with \"MZ\" as first 2 bytes \n   evades detection. \n\n   Affected products -\n   Command 5.2.11.5, Emsisoft 5.1.0.1, F-Prot 4.6.2.117, Fortinent 4.2.254.0, \n   Ikarus T3.1.1.97.0, K7AntiVirus 9.77.3565, NOD32 5795, Norman 6.06.12, \n   PCTools 7.0.3.5, Rising 22.83.00.03, VirusBuster 13.6.151.0\n\n   CVE no - \n   CVE-2012-1423\n\n6. Specially crafted infected POSIX TAR files with \"\\19\\04\\00\\10\" at offset 8\n   evades detection. \n\n   Affected products -\n   Antiy-AVL 2.0.3.7, CAT-QuickHeal 11.00, Jiangmin 13.0.900, Norman 6.06.12, \n   PCTools 7.0.3.5, Sophos 4.61.0\n\n   CVE no - \n   CVE-2012-1424\n\n\n7. Specially crafted infected POSIX TAR files with \"\\50\\4B\\03\\04\" as the first\n   4 bytes evades detection. \n\n   Affected products -\n   AntiVir 7.11.1.163, Antiy-AVL 2.0.3.7, CAT-QuickHeal 11.00, Emsisoft 5.1.0.1,\n   Fortinet 4.2.254.0, Ikarus T3.1.1.97.0, Jiangmin 13.0.900, \n   Kaspersky 7.0.0.125, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, \n   NOD32 5795, Norman 6.06.12, PCTools 7.0.3.5, Symantec 20101.3.0.103, \n   TrendMicro 9.120.0.1004, TrendMicro-HouseCall 9.120.0.1004 \n\n   CVE no - \n   CVE-2012-1425\n\n8. Specially crafted infected POSIX TAR files with \"\\42\\5A\\68\" as the first\n   3 bytes evades detection. \n\n   Affected products -\n   CAT-QuickHeal 11.00, Command 5.2.11.5, F-Prot 4.6.2.117, \n   K7AntiVirus 9.77.3565, Norman 6.06.12, Rising 22.83.00.03\n\n   CVE no - \n   CVE-2012-1426\n\n\n9. Specially crafted infected POSIX TAR files with \"\\57\\69\\6E\\5A\\69\\70\" at \n   offset 29 evades detection. \n\n   Affected products -\n   CAT-QuickHeal 11.00, Norman 6.06.12, Sophos 4.61.0\n\n   CVE no - \n   CVE-2012-1427\n\n10. Specially crafted infected POSIX TAR files with \"\\4a\\46\\49\\46\" at offset 6\n   evades detection. \n   \n   Affected products -\n   CAT-QuickHeal 11.00,  Norman 6.06.12, Sophos 4.61.0\n\n   CVE no - \n   CVE-2012-1428\n\n11. Specially crafted infected ELF files with \"ustar\" at offset 257\n   evades detection. \n\n   Affected products -\n   BitDefender 7.2, Comodo 7424, Emsisoft 5.1.0.1, eSafe 7.0.17.0, \n   F-Secure 9.0.16160.0, Ikarus T3.1.1.97.0, McAfee 5.400.0.1158, \n   McAfee-GW-Edition 2010.1C, nProtect 2011-01-17.01 \n\n   CVE no - \n   CVE-2012-1429\n12. Specially crafted infected ELF files with \"\\19\\04\\00\\10\" at offset 8 evades\n   detection. Specially crafted infected ELF files with \"\\4a\\46\\49\\46\" at offset 6 evades\n   detection. \n\n   Affected products -\n   BitDefender 7.2, Command 5.2.11.5, Comodo 7424, eSafe 7.0.17.0, \n   F-Prot 4.6.2.117, F-Secure 9.0.16160.0, McAfee-GW-Edition 2010.1C, \n   nProtect 2011-01-17.01, Sophos 4.61.0, Rising 22.83.00.03\n\n   CVE no - \n   CVE-2012-1431\n\n14. Specially crafted infected MS EXE files with \"\\57\\69\\6E\\5A\\69\\70\" at offset\n   29 evades detection. \n\n   Affected products -\n   Emsisoft 5.1.0.1, eSafe 7.0.17.0, Ikarus T3.1.1.97.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1432\n\n15. Specially crafted infected MS EXE files with \"\\4a\\46\\49\\46\" at offset\n   6 evades detection. \n\n   Affected products -\n   AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, \n   Ikarus T3.1.1.97.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1433\n\n16. Specially crafted infected MS EXE files with \"\\19\\04\\00\\10\" at offset\n   8 evades detection. \n\n   Affected products -\n   AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, Ikarus T3.1.1.97.0, \n   Panda 10.0.2.7\n   \n   CVE no - \n   CVE-2012-1434\n\n17. Specially crafted infected MS EXE files with \"\\50\\4B\\4C\\49\\54\\45\" at \n   offset 30 evades detection. \n   \n   Affected products - \n   AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, \n   Ikarus T3.1.1.97.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1435\n\n18. Specially crafted infected MS EXE files with \"\\2D\\6C\\68\" at \n   offset 2 evades detection. \n \n   Affected products - \n   AhnLab-V3 2011.01.18.00, Emsisoft 5.1.0.1, eSafe 7.0.17.0, \n   Ikarus T3.1.1.97.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1436\n\n19. Specially crafted infected MS Office files with \"\\50\\4B\\53\\70\\58\" at \n   offset 526 evades detection. \n   \n   Affected products - \n   Comodo 7425\n   \n   CVE no - \n   CVE-2012-1437\n\n20. Specially crafted infected MS Office files with \"ustar\" at \n   offset 257 evades detection. \n\n   Affected products - \n   Comodo 7425, Sophos 4.61.0 \n\n   CVE no - \n   CVE-2012-1438\n\n21. \u0027padding\u0027 field in ELF files is parsed incorrectly. \n    If an infected ELF file\u0027s padding field is incremented by 1 it evades\n    detection.    \n\n   Affected products - \n   eSafe 7.0.17.0, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1439\n\n22. \u0027identsize\u0027 field in ELF files is parsed incorrectly. \n    If an infected ELF file\u0027s identsize field is incremented by 1 it evades\n    detection.    \n\n   Affected products - \n   Norman 6.06.12, eSafe 7.0.17.0, eTrust-Vet 36.1.8511, Fortinet 4.2.254.0, \n   Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1440\n\n23. \u0027e_ip\u0027 and \u0027e_res\u0027 field in MS EXE files are parsed incorrectly.  \n    If any of these fields in an infected MS EXE file is incremented by 1 \n    it evades detection.    \n\n   Affected products - \n   Prevx 3.0\n\n   \u0027e_minalloc\u0027, \u0027e_res2\u0027,\u0027e_cparhdr\u0027, \u0027e_crlc\u0027, \u0027e_lfarlc\u0027,\u0027e_maxalloc\u0027,\n    \u0027e_oeminfo\u0027, \u0027e_ovno\u0027, \u0027e_cs\u0027, \u0027e_csum\u0027,\u0027e_sp\u0027, \u0027e_ss\u0027, \u0027e_cblp\u0027 and \n    \u0027e_oemid\u0027 fields in MS EXE files are parsed incorrectly.  \n    If any of these fields in an infected MS EXE file is incremented by 1 \n    it evades detection.    \n\n   Affected products - \n   eSafe 7.0.017.0, Prevx 3.0\n\n\n   CVE no - \n   CVE-2012-1441\n\n24. \u0027class\u0027 field in ELF files is parsed incorrectly.  \n    If an infected ELF file\u0027s class field is incremented by 1 it evades\n    detection. \n\n   Affected products - \n   CAT-QuickHeal 11.00, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, \n   eSafe 7.0.017.0, Kaspersky 7.0.0.125, F-Secure 9.0.16160.0, \n   Sophos 4.61.0, Antiy-AVL 2.0.3.7, Rising 22.83.00.03, Fortinet 4.2.254.0, \n   Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1442\n\n25. Infected RAR files with initial two bytes set to \u0027MZ\u0027 can be fixed by the \n    user and correctly extracted. Such a file evades detection.  \n    \n   Affected products -\n   ClamAV 0.96.4, Rising 22.83.00.03, CAT-QuickHeal 11.00, GData 21, \n   Symantec 20101.3.0.103, Command 5.2.11.5, Ikarus T3.1.1.97.0, \n   Emsisoft 5.1.0.1, PCTools 7.0.3.5, F-Prot 4.6.2.117, \n   VirusBuster 13.6.151.0, Fortinent 4.2.254.0, Antiy-AVL 2.0.3.7, \n   K7AntiVirus 9.77.3565, TrendMicro-HouseCall 9.120.0.1004,Kaspersky 7.0.0.125 \n   Jiangmin 13.0.900. Microsoft 1.6402, Sophos 4.61.0, NOD32 5795, AntiVir 7.11.1.163, \n   Norman 6.06.12, McAfee 5.400.0.1158, Panda 10.0.2.7, McAfee-GW-Edition 2010.1C, \n   TrendMicro 9.120.0.1004, Comodo 7424, BitDefender 7.2, eSafe 7.0.17.0, F-Secure 9.0.16160.0\n   nProtect 2011-01-17.01, AhnLab-V3 2011.01.18.00, AVG 10.0.0.1190, Avast 4.8.1351.0, \n   Avast5 5.0.677.0, VBA32 3.12.14.2   \n\n   CVE no - \n   CVE-2012-1443\n\n26. \u0027abiversion\u0027 field in ELF files is parsed incorrectly.  \n    If an infected ELF file\u0027s abiversion field is incremented by 1 it evades\n    detection. \n\n   Affected products - \n   eSafe 7.0.017.0, Prevx 3.0, Fortinet 4.2.254.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1444\n\n27. \u0027abi\u0027 field in ELF files is parsed incorrectly.  \n    If an infected ELF file\u0027s abi field is incremented by 1 it evades\n    detection. \n\n   Affected products - \n   eSafe 7.0.017.0, Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1445\n\n28. \u0027encoding\u0027 field in ELF files is parsed incorrectly.  \n    If an infected ELF file\u0027s encoding field is incremented by 1 it evades\n    detection. \n\n   Affected products - \n   CAT-QuickHeal 11.00, McAfee 5.400.0.1158, Symantec 20101.3.0.103, \n   Norman 6.06.12, eSafe 7.0.017.0, Kaspersky 7.0.0.125, \n   McAfee-GW-Edition 2010.1C, Sophos 4.61.0, eTrust-Vet 36.1.8511, \n   Antiy-AVL 2.0.3.7, PCTools 7.0.3.5, Rising 22.83.00.03, Fortinet 4.2.254.0,\n   Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1446\n\n29. \u0027e_version\u0027 field in ELF files is parsed incorrectly.  \n    If an infected ELF file\u0027s e_version field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n    Fortinet 4.2.254.0, eSafe 7.0.017.0, DrWeb 5.0.2.03300, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1447\n\n30. \u0027cbCabinet\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s cbCabinet field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   CAT-QuickHeal 11.00, TrendMicro 9.120.0.1004, Ikarus T3.1.1.97.0\n   TrendMicro-HouseCall 9.120.0.1004, Emsisoft 5.1.0.1 \n\n   CVE no - \n   CVE-2012-1448\n\n31. \u0027vMajor\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s vMajor field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   NOD32 5795, Rising 22.83.00.03\n   \n   CVE no - \n   CVE-2012-1449\n\n32. \u0027reserved3\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s reserved field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   Emsisoft 5.1.0.1, Sophos 4.61.0, Ikarus T3.1.1.97.0\n   \n   CVE no - \n   CVE-2012-1450\n\n33. \u0027reserved2\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s reserved2 field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   Emsisoft 5.1.0.1, Ikarus T3.1.1.97.0\n   \n   CVE no - \n   CVE-2012-1451\n\n34. \u0027reserved1\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s reserved field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   Emsisoft 5.1.0.1, Ikarus T3.1.1.97.0, CAT-QuickHeal 11.00\n   \n   CVE no - \n   CVE-2012-1452\n\n35. \u0027coffFiles\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s coffFiles field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   McAfee 5.0.2.03300, TrendMicro-HouseCall 9.120.0.1004, Kaspersky 7.0.0.125, \n   Sophos 4.61.0, TrendMicro 9.120.0.1004, McAfee-GW-Edition 2010.1C,\n   Emsisoft 5.1.0.1, eTrust-Vet 36.1.8511, Antiy-AVL 2.0.3.7, Microsoft 1.6402,\n   Rising 22.83.00.03, Ikarus T3.1.1.97.0, Fortinet 4.2.254.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1453\n\n36. \u0027ei_version\u0027 field in ELF files is parsed incorrectly.  \n    If an infected ELF file\u0027s version field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   McAfee 5.0.02.03300, eSafe 7.0.17.0, McAfee-GW-Edition 2010.1C, \n   Rising 22.83.00.03, Fortinet 4.2.254.0, Panda 10.0.2.7\n\n   CVE no - \n   CVE-2012-1454\n\n37. \u0027vMinor\u0027 field in CAB files is parsed incorrectly.  \n    If an infected CAB file\u0027s version field is incremented by 1 it evades\n    detection. \n\n   Affected products -\n   NOD32 5795, Rising 22.83.00.03\n \n   CVE no - \n   CVE-2012-1455\n\n38. A specially crafted ZIP file, created by concatenating the contents \n   of a clean TAR archive and a virus-infected ZIP archive, is parsed \n   incorrectly and evades detection. If the length field in the header of a file with test EICAR virus\n   included into a TAR archive is set to be greater than the archive\u0027s total \n   length (1,000,000+original length in our experiments), the antivirus \n   declares the file to be clean but virus gets extracted correctly by the \n   GNU tar program. \n\n   Affected products -\n   AntiVir 7.11.1.163, Antiy-AVL 2.0.3.7, Avast 4.8.1351.0, Avast5 5.0.677.0, \n   AVG 10.0.0.1190, BitDefender 7.2, CAT-QuickHeal 11.00, ClamAV 0.96.4, \n   Command 5.2.11.5, Emsisoft 5.1.0.1, eSafe 7.0.17.0, F-Prot 4.6.2.117, \n   GData 21, Ikarus T3.1.1.97.0, Jiangmin 13.0.900, K7AntiVirus 9.77.3565, \n   Kaspersky 7.0.0.125, McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, \n   Microsoft 1.6402, NOD32 5795, Norman 6.06.12, PCTools 7.0.3.5, \n   Rising 22.83.00.03, Symantec 20101.3.0.103, TrendMicro 9.120.0.1004, \n   TrendMicro-HouseCall 9.120.0.1004, VBA32 3.12.14.2, VirusBuster 13.6.151.0 \n\n   CVE no - \n   CVE-2012-1457\n\n40. A Windows Compiled HTML Help (CHM) file is a set of HTML files,\n   scripts, and images compressed using the LZX algorithm. \n   For faster random accesses, the algorithm is reset at intervals\n   instead of compressing the entire file as a single stream. The\n   length of each interval is specified in the LZXC header. \n\n   If an infected CHM file\u0027s header modified so that the reset interval\n   is lower than in the original file, the antivirus declares the file\n   to be clean. But the Windows CHM viewer hh.exe correctly decompresses\n   the infected content located before the tampered header. \n\n   Affected products -\n   ClamAV 0.96.4, Sophos 4.61.0 \n\n   CVE no - \n   CVE-2012-1458\n\n41. In a POSIX TAR archive, each member file has a 512-byte header protected\n   by a simple checksum. Every header also contains a file length field, which\n   is used by the extractor to locate the next header in the archive. \n\n   If a TAR archive contains two files: the first one is clean, while\n   the second is infected with test EICAR virus - and it is modified such that \n   the length field in the header of the first, clean file to point into the \n   middle of the header of the second, infected file. The antivirus declares \n   the file to be clean but virus gets extracted correctly by the \n   GNU tar program. If an infected tar.gz archive is appended 6 random bytes at the end, \n    the antivirus declares the file to be clean but virus gets extracted by\n    the gunzip+tar programs correctly by ignoring these bytes. \n\n   Affected products -\n   Antiy-AVL 2.0.3.7, CAT-QuickHeal 11.00, Command 5.2.11.5, \n   eSafe 7.0.17.0, F-Prot 4.6.2.117, Jiangmin 13.0.900, \n   K7AntiVirus 9.77.3565, VBA32 3.12.14.2 \n   \n   CVE no - \n   CVE-2012-1460\n\n43. GZIP files can contain multiple compressed streams, which are assembled\n    when the contents are extracted. If an infected .tar.gz file is broken \n    into two streams, the antivirus declares the infected .tar.gz file to \n    be clean while tar+gunzip extract the virus correctly\n\n   Affected products -\n   AVG 10.0.0.1190, BitDefender 7.2, Command 5.2.11.5, Emsisoft 5.1.0.1, \n   F-Secure 9.0.16160.0, Fortinent 4.2.254.0, Ikarus T3.1.1.97.0, \n   Jiangmin 13.0.900, K7AntiVirus 9.77.3565, Kaspersky 7.0.0.125, \n   McAfee 5.400.0.1158, McAfee-GW-Edition 2010.1C, NOD32 5795, Norman 6.06.12, \n   Rising 22.83.00.03, Sophos 4.61.0, Symantec 20101.3.0.103, \n   TrendMicro 9.120.0.1004, TrendMicro-HouseCall 9.120.0.1004, VBA32 3.12.14.2 \n\n   CVE no - \n   CVE-2012-1461\n\n44. If an infected ZIP archive is prepended with 1024 random bytes at the \n   beginning, the antivirus declares the file to be clean but virus gets extracted\n   by the unzip program correctly by skipping these bytes\n\n   Affected products -\n   AhnLab-V3 2011.01.18.00, AVG 10.0.0.1190, CAT-QuickHeal 11.00, \n   Emsisoft 5.1.0.1, eSafe 7.0.17.0, Fortinent 4.2.254.0, Ikarus T3.1.1.97.0, \n   Jiangmin 13.0.900, Kaspersky 7.0.0.125, Norman 6.06.12, Sophos 4.61.0, \n   Symantec 20101.3.0.103 \n\n   CVE no - \n   CVE-2012-1462\n\n45. In most ELF files, the 5th byte of the header indicates endianness: 01\n   for little-endian, 02 for bigendian. Linux kernel, however, does not\n   check this field before loading an ELF file. If an infected ELF file\u0027s 5-th \n   byte is set to 02, the antivirus declares the file to be clean but the ELF \n   file gets executed correctly. \n\n   Affected products -\n   AhnLab-V3 2011.01.18.00, BitDefender 7.2, CAT-QuickHeal 11.00, Command 5.2.11.5, \n   Comodo 7424, eSafe 7.0.17.0, F-Prot 4.6.2.117, F-Secure 9.0.16160.0, \n   McAfee 5.400.0.1158, Norman 6.06.12, nProtect 2011-01-17.01, Panda 10.0.2.7 \n\n   CVE no - \n   CVE-2012-1463\n\n--------\nCredits\n--------\nVulnerabilities found and advisory written by Suman Jana and Vitaly Shmatikov. \n\n-----------\nReferences\n-----------\n\"Abusing File Processing in Malware Detectors for Fun and Profit\" by Suman Jana and Vitaly Shmatikov\nTo appear in IEEE Symposium on Security and Privacy 2012\nhttp://www.ieee-security.org/TC/SP2012/ \n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "BID",
        "id": "52591"
      },
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "db": "PACKETSTORM",
        "id": "110990"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-1431",
        "trust": 2.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396",
        "trust": 0.7
      },
      {
        "db": "BUGTRAQ",
        "id": "20120319 EVASION ATTACKS EXPOLITING FILE-PARSING VULNERABILITIES IN ANTIVIRUS PRODUCTS",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "52591",
        "trust": 0.4
      },
      {
        "db": "VULHUB",
        "id": "VHN-54712",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "110990",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "db": "BID",
        "id": "52591"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "PACKETSTORM",
        "id": "110990"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "id": "VAR-201203-0391",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:10:08.119000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.authentium.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.rising-global.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.bitdefender.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.comodo.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.f-secure.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.f-prot.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.mcafee.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.nprotect.com/"
      },
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.sophos.com/"
      },
      {
        "title": "eSafe",
        "trust": 0.8,
        "url": "http://www.aladdin.co.jp/esafe/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/archive/1/522005"
      },
      {
        "trust": 1.7,
        "url": "http://www.ieee-security.org/tc/sp2012/program.html"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1431"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1431"
      },
      {
        "trust": 0.3,
        "url": "http://www.authentium.com"
      },
      {
        "trust": 0.3,
        "url": "http://www.bitdefender.com"
      },
      {
        "trust": 0.3,
        "url": "http://www.comodo.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.safenet-inc.com/data-protection/content-security-esafe/"
      },
      {
        "trust": 0.3,
        "url": "http://www.f-secure.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.f-prot.com/"
      },
      {
        "trust": 0.3,
        "url": "http://global.nprotect.com/index.php"
      },
      {
        "trust": 0.3,
        "url": "http://www.mcafee.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.rising-global.com/"
      },
      {
        "trust": 0.3,
        "url": "http://www.sophos.com/"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/522005"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1419"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1439"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1426"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1429"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1436"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1440"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1432"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1438"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1428"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1446"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1443"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1444"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1441"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1421"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1430"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1434"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1435"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1424"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1431"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1425"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1423"
      },
      {
        "trust": 0.1,
        "url": "http://www.ieee-security.org/tc/sp2012/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1442"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1422"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1433"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1420"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1427"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1445"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1437"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "db": "BID",
        "id": "52591"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "PACKETSTORM",
        "id": "110990"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "db": "BID",
        "id": "52591"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "db": "PACKETSTORM",
        "id": "110990"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-03-21T00:00:00",
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "date": "2012-03-20T00:00:00",
        "db": "BID",
        "id": "52591"
      },
      {
        "date": "2012-03-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "date": "2012-03-19T23:51:01",
        "db": "PACKETSTORM",
        "id": "110990"
      },
      {
        "date": "2012-03-21T10:11:47.630000",
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "date": "2012-03-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-03-27T00:00:00",
        "db": "VULHUB",
        "id": "VHN-54712"
      },
      {
        "date": "2012-03-20T00:00:00",
        "db": "BID",
        "id": "52591"
      },
      {
        "date": "2012-03-26T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      },
      {
        "date": "2012-03-27T04:00:00",
        "db": "NVD",
        "id": "CVE-2012-1431"
      },
      {
        "date": "2012-04-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple products  ELF Vulnerability that prevents file parsers from detecting malware",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-001893"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201203-396"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.