Unscored severity · published Mar 21, 2012
CVE-2012-1425
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0,…
–
CVSS
93.2%
EPSS
No
On KEV
Description
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \50\4B\03\04 character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Exploitation
Is it being used?
Exploit prediction (EPSS)93.2% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Anti-malware · Emsisoft
5.1.0.1 · source: NVD
AN
Antivir · Avira
7.11.1.163 · source: NVD
AS
Avl Sdk · Antiy
2.0.3.7 · source: NVD
EP
Endpoint Protection · Symantec
11.0 · source: NVD
FA
Fortinet Antivirus · Fortinet
4.2.254.0 · source: NVD
GA
Gateway · Mcafee
2010.1c · source: NVD
HO
Housecall · Trendmicro
9.120.0.1004 · source: NVD
IV
Ikarus Virus Utilities T3 Command Line Scanner · Ikarus
1.1.97.0 · source: NVD
JA
Jiangmin Antivirus · Jiangmin
13.0.900 · source: NVD
KA
Kaspersky Anti-virus · Kaspersky
7.0.0.125 · source: NVD
NA
Nod32 Antivirus · Eset
5795 · source: NVD
NA
Norman Antivirus & Antispyware · Norman
6.06.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1425
osvdb.org
http://osvdb.org/80389
osvdb.org
http://osvdb.org/80391
osvdb.org
http://osvdb.org/80392
osvdb.org
http://osvdb.org/80395
osvdb.org
http://osvdb.org/80396
osvdb.org
http://osvdb.org/80403
More from Avl Sdk
–
CVE-2012-1460
The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Jiangmin…
–
CVE-2012-1459
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus…
–
CVE-2012-1457
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal…
–
CVE-2012-1453
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee…
–
CVE-2012-1446
The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman…