Lucene search

[email protected]CVE-2020-9399

HistoryFeb 28, 2020 - 2:15 p.m.

CVE-2020-9399

2020-02-2814:15:10

CWE-436

[email protected]

web.nvd.nist.gov

avast

antivirus

virus detection

bypass

zip archive

cve-2020-9399

security vulnerability

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

23.6%

JSON

The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux.

Affected configurations

NVD

Node

avastantivirus_for_linuxRange<12.0

avastantivirus_proRange<12.0

avastantivirus_pro_plusRange<12.0

CPENameOperatorVersion
avast:antivirus_for_linuxavast antivirus for linuxlt12.0
avast:antivirus_proavast antivirus prolt12.0
avast:antivirus_pro_plusavast antivirus pro pluslt12.0

CPE	Name	Operator	Version
avast:antivirus_for_linux	avast antivirus for linux	lt	12.0
avast:antivirus_pro	avast antivirus pro	lt	12.0
avast:antivirus_pro_plus	avast antivirus pro plus	lt	12.0

References

blog.zoller.lu/p/tzo-23-2020-avast-generic-archive.html

seclists.org/fulldisclosure/2020/Feb/35

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

5.5 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

23.6%

JSON

Related for CVE-2020-9399

prion1 cvelist1 nvd1