CVE-2012-1443
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft Anti-Malware 5.1.0.1, PC Tools AntiVirus 7.0.3.5, F-Prot Antivirus 4.6.2.117, VirusBuster 13.6.151.0, Fortinet Antivirus 4.2.254.0, Antiy Labs AVL SDK 2.0.3.7, K7 AntiVirus 9.77.3565, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Jiangmin Antivirus 13.0.900, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Sophos Anti-Virus 4.61.0, NOD32 Antivirus 5795, Avira AntiVir 7.11.1.163, Norman Antivirus 6.06.12, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Panda Antivirus 10.0.2.7, McAfee Gateway (formerly Webwasher) 2010.1C, Trend Micro AntiVirus 9.120.0.1004, Comodo Antivirus 7424, Bitdefender 7.2, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, nProtect Anti-Virus 2011-01-17.01, AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, avast! Antivirus 4.8.1351.0 and 5.0.677.0, and VBA32 3.12.14.2 allows user-assisted remote attackers to bypass malware detection via a RAR file with an initial MZ character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different RAR parser implementations.
El analizador de archivos RAR en ClamAV versión 0.96.4, Rising Antivirus versión 22.83.00.03, Quick Heal (también se conoce como Cat QuickHeal) versión 11.00, G Data AntiVirus versión 21, AVEngine versión 20101.3.0.103 en Symantec Endpoint Protection versión 11, Command Antivirus versión 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner versión 1.1.97.0, Emsisoft Anti-Malware versión 5.1.0.1, PC Tools AntiVirus versión 7.0.3.5, F-Prot Antivirus versión 4.6.2.117, VirusBuster versión 13.6.151.0, Fortinet antivirus versión 4.2.254.0, Antiy Labs AVL SDK versión 2.0.3.7, K7 AntiVirus versión 9.77.3565, Trend Micro HouseCall versión 9.120.0.1004, Kaspersky Antivirus versión 7.0.0.125, Jiangmin Antivirus versión 13.0.900, Antimalware Engine versión 1.1.6402.0 en Microsoft Security Essentials versión 2.0, Sophos Anti-Virus versión 4.61.0, NOD32 Antivirus versión 5795, Avira AntiVir versión 7.11.1.163, Norman Antivirus versión 6.06.12, McAfee Anti-Virus Scanning Engine versión 5.400.0.1158, Panda Antivirus versión 10.0.2.7, McAfee Gateway (anteriormente Webwasher) versión 2010.1C, Trend Micro AntiVirus versión 9.120.0.1004, Comodo Antivirus versión 7424, Bitdefender versión 7.2, eSafe versión 7.0.17.0, F-Secure Anti-Virus versión 9.0.16160.0, nProtect Versión antivirus 2011-01-17.01, AhnLab V3 Internet Security versión 2011.01.18.00, AVG Anti-Virus versión 10.0.0.1190, avast! antivirus versiones 4.8.1351.0 y 5.0.677.0, y VBA32 versión 3.12.14.2, permite a los atacantes remotos asistidos por el usuario omitir la detección de malware por medio de un archivo RAR con una inicial Secuencia de caracteres MZ. NOTA: esto puede ser más tarde SPLIT en varios CVE si se publica información adicional que muestra que el error se produjo de manera independiente en diferentes implementaciones de analizador RAR.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-02-29 CVE Reserved
- 2012-03-19 CVE Published
- 2024-08-06 CVE Updated
- 2024-11-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/80454 | Vdb Entry | |
| http://osvdb.org/80455 | Vdb Entry | |
| http://osvdb.org/80456 | Vdb Entry | |
| http://osvdb.org/80457 | Vdb Entry | |
| http://osvdb.org/80458 | Vdb Entry | |
| http://osvdb.org/80459 | Vdb Entry | |
| http://osvdb.org/80460 | Vdb Entry | |
| http://osvdb.org/80461 | Vdb Entry | |
| http://osvdb.org/80467 | Vdb Entry | |
| http://osvdb.org/80468 | Vdb Entry | |
| http://osvdb.org/80469 | Vdb Entry | |
| http://osvdb.org/80470 | Vdb Entry | |
| http://osvdb.org/80471 | Vdb Entry | |
| http://osvdb.org/80472 | Vdb Entry | |
| http://www.ieee-security.org/TC/SP2012/program.html | X_refsource_misc | |
| http://www.securityfocus.com/archive/1/522005 | Mailing List | |
| http://www.securityfocus.com/bid/52612 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ahnlab Search vendor "Ahnlab" | V3 Internet Security Search vendor "Ahnlab" for product "V3 Internet Security" | 2011.01.18.00 Search vendor "Ahnlab" for product "V3 Internet Security" and version "2011.01.18.00" | - |
Affected
| ||||||
| Aladdin Search vendor "Aladdin" | Esafe Search vendor "Aladdin" for product "Esafe" | 7.0.17.0 Search vendor "Aladdin" for product "Esafe" and version "7.0.17.0" | - |
Affected
| ||||||
| Alwil Search vendor "Alwil" | Avast Antivirus Search vendor "Alwil" for product "Avast Antivirus" | 4.8.1351.0 Search vendor "Alwil" for product "Avast Antivirus" and version "4.8.1351.0" | - |
Affected
| ||||||
| Alwil Search vendor "Alwil" | Avast Antivirus Search vendor "Alwil" for product "Avast Antivirus" | 5.0.677.0 Search vendor "Alwil" for product "Avast Antivirus" and version "5.0.677.0" | - |
Affected
| ||||||
| Anti-virus Search vendor "Anti-virus" | Vba32 Search vendor "Anti-virus" for product "Vba32" | 3.12.14.2 Search vendor "Anti-virus" for product "Vba32" and version "3.12.14.2" | - |
Affected
| ||||||
| Antiy Search vendor "Antiy" | Avl Sdk Search vendor "Antiy" for product "Avl Sdk" | 2.0.3.7 Search vendor "Antiy" for product "Avl Sdk" and version "2.0.3.7" | - |
Affected
| ||||||
| Authentium Search vendor "Authentium" | Command Antivirus Search vendor "Authentium" for product "Command Antivirus" | 5.2.11.5 Search vendor "Authentium" for product "Command Antivirus" and version "5.2.11.5" | - |
Affected
| ||||||
| Avg Search vendor "Avg" | Avg Anti-virus Search vendor "Avg" for product "Avg Anti-virus" | 10.0.0.1190 Search vendor "Avg" for product "Avg Anti-virus" and version "10.0.0.1190" | - |
Affected
| ||||||
| Avira Search vendor "Avira" | Antivir Search vendor "Avira" for product "Antivir" | 7.11.1.163 Search vendor "Avira" for product "Antivir" and version "7.11.1.163" | - |
Affected
| ||||||
| Bitdefender Search vendor "Bitdefender" | Bitdefender Search vendor "Bitdefender" for product "Bitdefender" | 7.2 Search vendor "Bitdefender" for product "Bitdefender" and version "7.2" | - |
Affected
| ||||||
| Cat Search vendor "Cat" | Quick Heal Search vendor "Cat" for product "Quick Heal" | 11.00 Search vendor "Cat" for product "Quick Heal" and version "11.00" | - |
Affected
| ||||||
| Clamav Search vendor "Clamav" | Clamav Search vendor "Clamav" for product "Clamav" | 0.96.4 Search vendor "Clamav" for product "Clamav" and version "0.96.4" | - |
Affected
| ||||||
| Comodo Search vendor "Comodo" | Comodo Antivirus Search vendor "Comodo" for product "Comodo Antivirus" | 7424 Search vendor "Comodo" for product "Comodo Antivirus" and version "7424" | - |
Affected
| ||||||
| Emsisoft Search vendor "Emsisoft" | Anti-malware Search vendor "Emsisoft" for product "Anti-malware" | 5.1.0.1 Search vendor "Emsisoft" for product "Anti-malware" and version "5.1.0.1" | - |
Affected
| ||||||
| Eset Search vendor "Eset" | Nod32 Antivirus Search vendor "Eset" for product "Nod32 Antivirus" | 5795 Search vendor "Eset" for product "Nod32 Antivirus" and version "5795" | - |
Affected
| ||||||
| F-prot Search vendor "F-prot" | F-prot Antivirus Search vendor "F-prot" for product "F-prot Antivirus" | 4.6.2.117 Search vendor "F-prot" for product "F-prot Antivirus" and version "4.6.2.117" | - |
Affected
| ||||||
| F-secure Search vendor "F-secure" | F-secure Anti-virus Search vendor "F-secure" for product "F-secure Anti-virus" | 9.0.16160.0 Search vendor "F-secure" for product "F-secure Anti-virus" and version "9.0.16160.0" | - |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | Fortinet Antivirus Search vendor "Fortinet" for product "Fortinet Antivirus" | 4.2.254.0 Search vendor "Fortinet" for product "Fortinet Antivirus" and version "4.2.254.0" | - |
Affected
| ||||||
| Gdata-software Search vendor "Gdata-software" | G Data Antivirus Search vendor "Gdata-software" for product "G Data Antivirus" | 21 Search vendor "Gdata-software" for product "G Data Antivirus" and version "21" | - |
Affected
| ||||||
| Ikarus Search vendor "Ikarus" | Ikarus Virus Utilities T3 Command Line Scanner Search vendor "Ikarus" for product "Ikarus Virus Utilities T3 Command Line Scanner" | 1.1.97.0 Search vendor "Ikarus" for product "Ikarus Virus Utilities T3 Command Line Scanner" and version "1.1.97.0" | - |
Affected
| ||||||
| Jiangmin Search vendor "Jiangmin" | Jiangmin Antivirus Search vendor "Jiangmin" for product "Jiangmin Antivirus" | 13.0.900 Search vendor "Jiangmin" for product "Jiangmin Antivirus" and version "13.0.900" | - |
Affected
| ||||||
| K7computing Search vendor "K7computing" | Antivirus Search vendor "K7computing" for product "Antivirus" | 9.77.3565 Search vendor "K7computing" for product "Antivirus" and version "9.77.3565" | - |
Affected
| ||||||
| Kaspersky Search vendor "Kaspersky" | Kaspersky Anti-virus Search vendor "Kaspersky" for product "Kaspersky Anti-virus" | 7.0.0.125 Search vendor "Kaspersky" for product "Kaspersky Anti-virus" and version "7.0.0.125" | - |
Affected
| ||||||
| Mcafee Search vendor "Mcafee" | Gateway Search vendor "Mcafee" for product "Gateway" | 2010.1c Search vendor "Mcafee" for product "Gateway" and version "2010.1c" | - |
Affected
| ||||||
| Mcafee Search vendor "Mcafee" | Scan Engine Search vendor "Mcafee" for product "Scan Engine" | 5.400.0.1158 Search vendor "Mcafee" for product "Scan Engine" and version "5.400.0.1158" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Security Essentials Search vendor "Microsoft" for product "Security Essentials" | 2.0 Search vendor "Microsoft" for product "Security Essentials" and version "2.0" | - |
Affected
| ||||||
| Norman Search vendor "Norman" | Norman Antivirus \& Antispyware Search vendor "Norman" for product "Norman Antivirus \& Antispyware" | 6.06.12 Search vendor "Norman" for product "Norman Antivirus \& Antispyware" and version "6.06.12" | - |
Affected
| ||||||
| Nprotect Search vendor "Nprotect" | Nprotect Antivirus Search vendor "Nprotect" for product "Nprotect Antivirus" | 2011-01-17.01 Search vendor "Nprotect" for product "Nprotect Antivirus" and version "2011-01-17.01" | - |
Affected
| ||||||
| Pandasecurity Search vendor "Pandasecurity" | Panda Antivirus Search vendor "Pandasecurity" for product "Panda Antivirus" | 10.0.2.7 Search vendor "Pandasecurity" for product "Panda Antivirus" and version "10.0.2.7" | - |
Affected
| ||||||
| Pc Tools Search vendor "Pc Tools" | Pc Tools Antivirus Search vendor "Pc Tools" for product "Pc Tools Antivirus" | 7.0.3.5 Search vendor "Pc Tools" for product "Pc Tools Antivirus" and version "7.0.3.5" | - |
Affected
| ||||||
| Rising-global Search vendor "Rising-global" | Rising Antivirus Search vendor "Rising-global" for product "Rising Antivirus" | 22.83.00.03 Search vendor "Rising-global" for product "Rising Antivirus" and version "22.83.00.03" | - |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Sophos Anti-virus Search vendor "Sophos" for product "Sophos Anti-virus" | 4.61.0 Search vendor "Sophos" for product "Sophos Anti-virus" and version "4.61.0" | - |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Endpoint Protection Search vendor "Symantec" for product "Endpoint Protection" | 11.0 Search vendor "Symantec" for product "Endpoint Protection" and version "11.0" | - |
Affected
| ||||||
| Trendmicro Search vendor "Trendmicro" | Housecall Search vendor "Trendmicro" for product "Housecall" | 9.120.0.1004 Search vendor "Trendmicro" for product "Housecall" and version "9.120.0.1004" | - |
Affected
| ||||||
| Trendmicro Search vendor "Trendmicro" | Trend Micro Antivirus Search vendor "Trendmicro" for product "Trend Micro Antivirus" | 9.120.0.1004 Search vendor "Trendmicro" for product "Trend Micro Antivirus" and version "9.120.0.1004" | - |
Affected
| ||||||
| Virusbuster Search vendor "Virusbuster" | Virusbuster Search vendor "Virusbuster" for product "Virusbuster" | 13.6.151.0 Search vendor "Virusbuster" for product "Virusbuster" and version "13.6.151.0" | - |
Affected
| ||||||