Multiple Vendors Antivirus Products for Windows Malware Detection Bypass Vulnerability

Bugtraq ID:	50569
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Nov 07 2011 12:00AM
Credit:	reset557
Vulnerable:	Norman Security Suite 8 G DATA AntiVirus 2012 Frisk Software F-Prot Antivirus 6.0.9 .0 Eset NOD32 Antivirus 5.0.93.0 Eset NOD32 Antivirus 5.0.93.0 Eset NOD32 Antivirus 4.2.71.2 Avast! Avast! Antivirus 6.0.1289
Not Vulnerable:

Multiple Vendors Antivirus Products for Windows Malware Detection Bypass Vulnerability

Multiple Vendors' Antivirus Products for Windows are prone to a vulnerability that may allow malware to bypass detection.

Attackers can place a malicious file on a computer which the affected antivirus applications will fail to detect. Successfully exploiting this issue may result in a complete compromise of the computer.

The following products are affected:

ESET NOD32 Antivirus
Avast! Antivirus
F-PROT Antivirus
G DATA Antivirus
Norman Security Suite

Multiple Vendors Antivirus Products for Windows Malware Detection Bypass Vulnerability

An attacker may exploit this issue by distributing malicious files to affected users.

Multiple Vendors Antivirus Products for Windows Malware Detection Bypass Vulnerability

Solution:
A vendor fix is available for Avast! Antivirus. Please contact the vendor for more information.

Currently we are not aware of any vendor-supplied patches for other products. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Vendors Antivirus Products for Windows Malware Detection Bypass Vulnerability

References:

• Avast! Homepage (Avast!)
  
• Eset NOD32 Homepage (ESET)
  
• F-Prot Home Page (F-PROT)
  
• G DATA Homepage (G DATA)
  
• Norman Security Suite (Norman)
  
• Malware detection evasion in antivirus software (reset557)