CVE-2012-1420

published 2012-03-21

CVE-2012-1420: The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus…

Priority P3 41 medium 4.3 CVSS 2.0

AV N AC M Au N C N I P A N

The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \7fELF character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
authentium	command_antivirus	—	—
cat	quick_heal	—	—
eset	nod32_antivirus	—	—
f-prot	f-prot_antivirus	—	—
fortinet	fortinet_antivirus	—	—
k7computing	antivirus	—	—
kaspersky	kaspersky_anti-virus	—	—
microsoft	security_essentials	—	—
norman	norman_antivirus_antispyware	—	—
pandasecurity	panda_antivirus	—	—
rising-global	rising_antivirus	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264