Multiple AntiVirus Products CVE-2012-1456 ZIP File Scan Evasion Vulnerability

Bugtraq ID:	52608
Class:	Design Error
CVE:	CVE-2012-1456
Remote:	Yes
Local:	No
Published:	Mar 20 2012 12:00AM
Updated:	Mar 20 2012 12:00AM
Credit:	Suman Jana and Vitaly Shmatikov
Vulnerable:	Quick Heal Technologies CAT-QuickHeal 11.00 Ikarus Antivirus T3.1.1.97.0 Frisk Software F-Prot Antivirus 4.6.2 117 Fortinet Antivirus 4.2.254 0 eSafe Antivirus 7.0.17 0 Emsisoft Antivirus 5.1 1 Comodo AntiVirus 7424 AVG AVG Anti-Virus 10.0 1190
Not Vulnerable:

Multiple AntiVirus Products CVE-2012-1456 ZIP File Scan Evasion Vulnerability

Multiple Antivirus products are prone to a vulnerability that may allow an attacker to bypass on-demand scans.

Successful exploits will allow attackers to bypass on-demand virus scanning, possibly allowing malicious files to escape detection.

The following products are affected:

AVG AVG Anti-Virus 10.0.0.1190
Quick Heal Technologies CAT-QuickHeal 11.00
Comodo AntiVirus 7424
Emsisoft Antivirus 5.1.0.1
eSafe Antivirus 7.0.17.0
Frisk Software F-Prot Antivirus 4.6.2.117
Fortinet Antivirus 4.2.254.0
Ikarus Antivirus T3.1.1.97.0

Multiple AntiVirus Products CVE-2012-1456 ZIP File Scan Evasion Vulnerability

Attackers can use standard, readily available tools to exploit this issue.

Multiple AntiVirus Products CVE-2012-1456 ZIP File Scan Evasion Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple AntiVirus Products CVE-2012-1456 ZIP File Scan Evasion Vulnerability

References:

• AVG Homepage (AVG)
  
• Comodo Homepage (Comodo)
  
• Emsisoft Homepage (Emsisoft)
  
• eSafe Homepage (eSafe)
  
• Fortinet Homepage (Fortinet)
  
• Frisk Software Homepage (Frisk Software)
  
• Ikarus Homepage (Ikarus)
  
• Quick Heal Technologies Homepage (Quick Heal Technologies)
  
• Evasion attacks expoliting file-parsing vulnerabilities in antivirus products (Suman Jana)