CVE-2012-1446

medium · 4.3

The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman Antivirus 6.06.12, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, McAfee Gateway (formerly Webwasher) 2010.1C, Sophos Anti-Virus 4.61.0, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified encoding field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.

4.3

CVSS

99.7%

EPSS (exploit prob.)

100th

EPSS percentile

2012-03-21

Published

AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

CWE-264

Affected products

Vendor	Product	Affected versions
aladdin	esafe	7.0.17.0
antiy	avl_sdk	2.0.3.7
ca	etrust_vet_antivirus	36.1.8511
cat	quick_heal	11.00
fortinet	fortinet_antivirus	4.2.254.0
kaspersky	kaspersky_anti-virus	7.0.0.125
mcafee	gateway	2010.1c
mcafee	scan_engine	5.400.0.1158
norman	norman_antivirus_&_antispyware	6.06.12
pandasecurity	panda_antivirus	10.0.2.7
pc_tools	pc_tools_antivirus	7.0.3.5
rising-global	rising_antivirus	22.83.00.03
sophos	sophos_anti-virus	4.61.0
symantec	endpoint_protection	11.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-1446