Multiple AntiVirus Products CVE-2012-1454 ELF File Scan Evasion Vulnerability

Bugtraq ID:	52606
Class:	Design Error
CVE:	CVE-2012-1454
Remote:	Yes
Local:	No
Published:	Mar 20 2012 12:00AM
Updated:	Mar 20 2012 12:00AM
Credit:	Suman Jana and Vitaly Shmatikov
Vulnerable:	Rising Antivirus 22.83 03 Panda Antivirus 10.0.2 7 McAfee McAfee-GW-Edition 2010.1C eSafe Antivirus 7.0.17 0
Not Vulnerable:

Multiple AntiVirus Products CVE-2012-1454 ELF File Scan Evasion Vulnerability

Multiple Antivirus products are prone to a vulnerability that may allow an attacker to bypass on-demand scans.

Successful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection.

The following products are affected:

eSafe Antivirus 7.0.17.0
McAfee McAfee-GW-Edition 2010.1C
Rising Antivirus 22.83.00.03
Panda Antivirus 10.0.2.7

Multiple AntiVirus Products CVE-2012-1454 ELF File Scan Evasion Vulnerability

Attackers can use standard, readily available tools to exploit this issue.

Multiple AntiVirus Products CVE-2012-1454 ELF File Scan Evasion Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple AntiVirus Products CVE-2012-1454 ELF File Scan Evasion Vulnerability

References:

• eSafe Homepage (eSafe)
  
• McAfee Homepage (McAfee)
  
• Panda Homepage (Panda)
  
• Rising Homepage (Rising International Software)
  
• Evasion attacks expoliting file-parsing vulnerabilities in antivirus products (Suman Jana)