CVE-2012-1457
published 2012-03-21CVE-2012-1457: The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender…
PriorityP344medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
98.29%
99.9th percentile
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aladdin | esafe | — | — |
| alwil | avast_antivirus | — | — |
| alwil | avast_antivirus | — | — |
| anti-virus | vba32 | — | — |
| antiy | avl_sdk | — | — |
| authentium | command_antivirus | — | — |
| avg | avg_anti-virus | — | — |
| avira | antivir | — | — |
| bitdefender | bitdefender | — | — |
| cat | quick_heal | — | — |
| clamav | clamav | — | — |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| debian | clamav | < clamav 0.97.5+dfsg-1 (bookworm) | clamav 0.97.5+dfsg-1 (bookworm) |
| emsisoft | anti-malware | — | — |
| eset | nod32_antivirus | — | — |
| f-prot | f-prot_antivirus | — | — |
| gdata-software | g_data_antivirus | — | — |
| ikarus | ikarus_virus_utilities_t3_command_line_scanner | — | — |
| jiangmin | jiangmin_antivirus | — | — |
| k7computing | antivirus | — | — |
| kaspersky | kaspersky_anti-virus | — | — |
| mcafee | gateway | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect TAR archives where any entry's length field value exceeds the total size of the TAR file — this is the evasion trigger for CVE-2012-1457 across all affected AV parsers. ↗
- →ClamAV specifically was confirmed vulnerable at version 0.96.4; the fix was introduced in ClamAV 0.97.5. Scan engines running versions below 0.97.5 should be flagged. ↗
- →A remote attacker can craft a TAR file containing malware that evades detection; inspect TAR files at the network perimeter for oversized entry length fields relative to the total archive size. ↗
- →The evasion technique was publicly disclosed via a BugTraq post titled 'Evasion attacks exploiting file-parsing vulnerabilities in antivirus products' on 2012-03-19; correlate IDS/proxy logs around that date for TAR file delivery. ↗
- ·The vulnerability may be split into multiple CVEs in the future if it is determined that each affected AV vendor's TAR parser failed independently; detections should account for all listed affected products. ↗
- ·The ClamAV fix (0.97.5) initially introduced a regression that could cause it to fail to scan certain documents; verify the regression fix (USN-1482-3) is also applied. ↗
- ·For Debian-based systems, the fix is present in ClamAV package version 0.97.5+dfsg-1 across all tracked suites (bookworm, bullseye, sid, trixie, forky). ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ClamAV regression
vendor_ubuntu·2012-08-16·CVSS 4.3
[MEDIUM] ClamAV regression
Title: ClamAV regression
Summary: USN-1482-1 introduced a regression in ClamAV that could cause it to fail
to scan certain documents.
USN-1482-1 fixed vulnerabilities in ClamAV. The updated package could
fail to properly scan files in some situations. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)
It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)
Instructions:
Ubuntu
ClamAV regression
vendor_ubuntu·2012-06-20·CVSS 4.3
[MEDIUM] ClamAV regression
Title: ClamAV regression
Summary: ClamAV could improperly detect malware if it opened a specially crafted file.
USN-1482-1 fixed vulnerabilities in ClamAV. The updated packages could fail
to install in certain situations. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)
It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)
Instructions: In general, a standard system
Ubuntu
ClamAV vulnerabilities
vendor_ubuntu·2012-06-19·CVSS 4.3
CVE-2012-1457 [MEDIUM] ClamAV vulnerabilities
Title: ClamAV vulnerabilities
Summary: ClamAV could improperly detect malware if it opened a specially crafted
file.
It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)
It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2012-1457: clamav - The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, ava...
vendor_debian·2012·CVSS 4.3
CVE-2012-1457 [MEDIUM] CVE-2012-1457: clamav - The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, ava...
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Prote
GHSA
GHSA-j7hj-5xvp-7w4p: The TAR file parser in Avira AntiVir 7
ghsa_unreviewed·2022-05-14
CVE-2012-1457 [MEDIUM] GHSA-j7hj-5xvp-7w4p: The TAR file parser in Avira AntiVir 7
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Prote
OSV
CVE-2012-1457: The TAR file parser in Avira AntiVir 7
osv·2012-03-21·CVSS 4.3
CVE-2012-1457 [MEDIUM] CVE-2012-1457: The TAR file parser in Avira AntiVir 7
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Prote
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-1457 clamav: overly long length field in tar files evade detection
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1457 [MEDIUM] CVE-2012-1457 clamav: overly long length field in tar files evade detection
CVE-2012-1457 clamav: overly long length field in tar files evade detection
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1457 to
the following vulnerability:
Name: CVE-2012-1457
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457
Assigned: 20120229
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
Reference: http://www.securityfocus.com/archive/1/522005
Reference: http://www.ieee-security.org/TC/SP2012/program.html
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK
2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus
10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00,
ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware
5.1.0.1, eSafe 7.
Bugzilla
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [epel-all]
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1419 [MEDIUM] CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [epel-all]
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/u
Bugzilla
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [fedora-all]
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1419 [MEDIUM] CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [fedora-all]
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.htmlhttp://osvdb.org/80389http://osvdb.org/80391http://osvdb.org/80392http://osvdb.org/80393http://osvdb.org/80395http://osvdb.org/80396http://osvdb.org/80403http://osvdb.org/80406http://osvdb.org/80407http://osvdb.org/80409http://www.ieee-security.org/TC/SP2012/program.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:094http://www.securityfocus.com/archive/1/522005http://www.securityfocus.com/bid/52610https://exchange.xforce.ibmcloud.com/vulnerabilities/74293http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.htmlhttp://osvdb.org/80389http://osvdb.org/80391http://osvdb.org/80392http://osvdb.org/80393http://osvdb.org/80395http://osvdb.org/80396http://osvdb.org/80403http://osvdb.org/80406http://osvdb.org/80407http://osvdb.org/80409http://www.ieee-security.org/TC/SP2012/program.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:094http://www.securityfocus.com/archive/1/522005http://www.securityfocus.com/bid/52610https://exchange.xforce.ibmcloud.com/vulnerabilities/74293
2012-03-21
Published