CVE-2012-1459
published 2012-03-21CVE-2012-1459: The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and…
PriorityP344medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
99.81%
100.0th percentile
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ahnlab | v3_internet_security | — | — |
| alwil | avast_antivirus | — | — |
| alwil | avast_antivirus | — | — |
| anti-virus | vba32 | — | — |
| antiy | avl_sdk | — | — |
| authentium | command_antivirus | — | — |
| avg | avg_anti-virus | — | — |
| avira | antivir | — | — |
| bitdefender | bitdefender | — | — |
| cat | quick_heal | — | — |
| clamav | clamav | — | — |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| clamav | clamav | >= 0 < 0.97.5+dfsg-1 | 0.97.5+dfsg-1 |
| comodo | comodo_antivirus | — | — |
| debian | clamav | < clamav 0.97.5+dfsg-1 (bookworm) | clamav 0.97.5+dfsg-1 (bookworm) |
| emsisoft | anti-malware | — | — |
| eset | nod32_antivirus | — | — |
| f-prot | f-prot_antivirus | — | — |
| f-secure | f-secure_anti-virus | — | — |
| fortinet | fortinet_antivirus | — | — |
| gdata-software | g_data_antivirus | — | — |
| ikarus | ikarus_virus_utilities_t3_command_line_scanner | — | — |
| jiangmin | jiangmin_antivirus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →A TAR archive entry with a length field set to the size of that entire entry plus part of the header of the next entry will cause vulnerable TAR parsers to skip scanning the next entry, bypassing malware detection. ↗
- →Malformed/specially-crafted TAR archives can be used to evade AV scanning in ClamAV and many other products; inspect TAR length fields for values that overlap into subsequent entry headers. ↗
- ·The vulnerability was confirmed present in ClamAV 0.96.4; it is unknown whether versions between 0.96.4 and 0.97.4 are also affected. The fix was introduced in ClamAV 0.97.5. ↗
- ·This CVE may be split into multiple CVEs in the future if the TAR parser bug is shown to have occurred independently across different vendor implementations. ↗
- ·The ClamAV 0.97.5 fix package introduced a regression that could cause ClamAV to fail to scan certain documents; a follow-up update was required. ↗
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
ClamAV regression
vendor_ubuntu·2012-08-16·CVSS 4.3
[MEDIUM] ClamAV regression
Title: ClamAV regression
Summary: USN-1482-1 introduced a regression in ClamAV that could cause it to fail
to scan certain documents.
USN-1482-1 fixed vulnerabilities in ClamAV. The updated package could
fail to properly scan files in some situations. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)
It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)
Instructions:
Ubuntu
ClamAV regression
vendor_ubuntu·2012-06-20·CVSS 4.3
[MEDIUM] ClamAV regression
Title: ClamAV regression
Summary: ClamAV could improperly detect malware if it opened a specially crafted file.
USN-1482-1 fixed vulnerabilities in ClamAV. The updated packages could fail
to install in certain situations. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)
It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)
Instructions: In general, a standard system
Ubuntu
ClamAV vulnerabilities
vendor_ubuntu·2012-06-19·CVSS 4.3
CVE-2012-1457 [MEDIUM] ClamAV vulnerabilities
Title: ClamAV vulnerabilities
Summary: ClamAV could improperly detect malware if it opened a specially crafted
file.
It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)
It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2012-1459: clamav - The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir ...
vendor_debian·2012·CVSS 4.3
CVE-2012-1459 [MEDIUM] CVE-2012-1459: clamav - The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir ...
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.0
GHSA
GHSA-6jh3-f3f4-37w5: The TAR file parser in AhnLab V3 Internet Security 2011
ghsa_unreviewed·2022-05-14
CVE-2012-1459 [MEDIUM] GHSA-6jh3-f3f4-37w5: The TAR file parser in AhnLab V3 Internet Security 2011
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.0
OSV
CVE-2012-1459: The TAR file parser in AhnLab V3 Internet Security 2011
osv·2012-03-21·CVSS 4.3
CVE-2012-1459 [MEDIUM] CVE-2012-1459: The TAR file parser in AhnLab V3 Internet Security 2011
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.0
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-1459 clamav: specially-crafted length field in tar files evade detection
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1459 [MEDIUM] CVE-2012-1459 clamav: specially-crafted length field in tar files evade detection
CVE-2012-1459 clamav: specially-crafted length field in tar files evade detection
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1459 to
the following vulnerability:
Name: CVE-2012-1459
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459
Assigned: 20120229
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
Reference: http://www.securityfocus.com/archive/1/522005
Reference: http://www.ieee-security.org/TC/SP2012/program.html
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00,
Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus
4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2,
Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus
Bugzilla
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [epel-all]
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1419 [MEDIUM] CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [epel-all]
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/u
Bugzilla
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [fedora-all]
bugzilla·2012-03-22·CVSS 4.3
CVE-2012-1419 [MEDIUM] CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [fedora-all]
CVE-2012-1419 CVE-2012-1443 CVE-2012-1457 CVE-2012-1458 CVE-2012-1459 clamav various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org
http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.htmlhttp://osvdb.org/80389http://osvdb.org/80390http://osvdb.org/80391http://osvdb.org/80392http://osvdb.org/80393http://osvdb.org/80395http://osvdb.org/80396http://osvdb.org/80403http://osvdb.org/80406http://osvdb.org/80407http://osvdb.org/80409http://www.ieee-security.org/TC/SP2012/program.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:094http://www.securityfocus.com/archive/1/522005http://www.securityfocus.com/bid/52623https://exchange.xforce.ibmcloud.com/vulnerabilities/74302http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.htmlhttp://osvdb.org/80389http://osvdb.org/80390http://osvdb.org/80391http://osvdb.org/80392http://osvdb.org/80393http://osvdb.org/80395http://osvdb.org/80396http://osvdb.org/80403http://osvdb.org/80406http://osvdb.org/80407http://osvdb.org/80409http://www.ieee-security.org/TC/SP2012/program.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:094http://www.securityfocus.com/archive/1/522005http://www.securityfocus.com/bid/52623https://exchange.xforce.ibmcloud.com/vulnerabilities/74302
2012-03-21
Published