McAfee Antivirus up to 5795 TAR File Parser access control

Summaryinfo

A vulnerability classified as critical was found in McAfee Antivirus up to 5795. This affects an unknown function of the component TAR File Parser. The manipulation results in access control. This vulnerability is cataloged as CVE-2012-1425. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability classified as critical has been found in McAfee Antivirus up to 5795 (Anti-Malware Software). Affected is an unknown function of the component TAR File Parser. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on integrity. CVE summarizes:

The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \50\4B\03\04 character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

The weakness was shared 03/19/2012 by Suman Jana and Vitaly Shmatikov as confirmed mailinglist post (Bugtraq). The advisory is available at seclists.org. The vendor was not involved in the coordination of the public release. This vulnerability is traded as CVE-2012-1425 since 02/29/2012. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

A public exploit has been developed by Suman Jana / Vitaly Shmatikov and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at OSVDB (80389†) and SecurityTracker (ID 1026840†). Further details are available at ieee-security.org. The entries VDB-4915, VDB-4916, VDB-4917 and VDB-4918 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Anti-Malware Software

Vendor

• McAfee

Name

• Antivirus

Version

• 4.2.254.0
• 6.06.12
• 7.0.3.5
• 9.120.0.1004
• 13.0.900
• 5795

License

• commercial

Website

• Vendor: https://www.mcafee.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion