Malware evasion Security Bypass - Ver2 (CVE-2012-1427)

A security bypass vulnerability has been reported in Cat Quick HealCat Quick Heal. An attacker could exploit this vulnerability via a POSIX TAR file with a 57696E5A6970 character sequence at a certain location. Successful exploitation of this vulnerability would allow remote attackers to bypass...

CVE-2012-1419

The TAR file parser in ClamAV 0.96.4 and Quick Heal aka Cat QuickHeal 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial aliases character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the...

CVE-2012-1421

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MSCF character sequence. NOTE:...

CVE-2012-1428

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs...

Design/Logic Flaw

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial ITSF character sequence. NOTE: this may later be SPLIT into multiple...

CVE-2012-1421

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MSCF character sequence. NOTE:...

CVE-2012-1419

The TAR file parser in ClamAV 0.96.4 and Quick Heal aka Cat QuickHeal 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial aliases character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the...

PT-2012-3245

Name of the Vulnerable Software and Affected Versions Quick Heal versions 11.00 Command Antivirus version 5.2.11.5 F-Prot Antivirus version 4.6.2.117 Fortinet Antivirus version 4.2.254.0 K7 AntiVirus version 9.77.3565 Kaspersky Anti-Virus version 7.0.0.125 Microsoft Security Essentials version 2....

PT-2012-3253

Name of the Vulnerable Software and Affected Versions Quick Heal versions 11.00 Norman Antivirus version 6.06.12 Sophos Anti-Virus version 4.61.0 Description The issue allows remote attackers to bypass malware detection. This is achieved through a POSIX TAR file containing a specific character...

PT-2012-3247

Name of the Vulnerable Software and Affected Versions Quick Heal versions 11.00 NOD32 Antivirus version 5795 Norman Antivirus version 6.06.12 Rising Antivirus version 22.83.00.03 Description The issue allows remote attackers to bypass malware detection. This is achieved via a POSIX TAR file with ...

PT-2012-3252

Name of the Vulnerable Software and Affected Versions Quick Heal versions 11.00 Norman Antivirus version 6.06.12 Sophos Anti-Virus version 4.61.0 Description The issue allows remote attackers to bypass malware detection. This is achieved through a POSIX TAR file containing a specific character...

CVE-2012-1426: Undefined Security Weakness

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, K7 AntiVirus 9.77.3565, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \42\5A\68...

CVE-2012-1427: Undefined Security Weakness

The TAR file parser in Quick Heal aka Cat QuickHeal 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \57\69\6E\5A\69\70 character sequence at a certain location. NOTE: this may later be SPLIT into multipl...