CVE-2012-1423: The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus…

PriorityP343medium4.3CVSS 2.0

AVNACMAuNCNIPAN

EPSS

89.86%

99.8th percentile

The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, K7 AntiVirus 9.77.3565, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MZ character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
authentium	command_antivirus	—	—
emsisoft	anti-malware	—	—
eset	nod32_antivirus	—	—
f-prot	f-prot_antivirus	—	—
fortinet	fortinet_antivirus	—	—
ikarus	ikarus_virus_utilities_t3_command_line_scanner	—	—
k7computing	antivirus	—	—
norman	norman_antivirus_antispyware	—	—
pc_tools	pc_tools_antivirus	—	—
rising-global	rising_antivirus	—	—
virusbuster	virusbuster	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.