Red Hat Bugzilla – Bug 806094
CVE-2012-1457 clamav: overly long length field in tar files evade detection
Last modified: 2013-01-29 18:05:21 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1457 to
the following vulnerability:
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
The TAR file parser in Avira AntiVir 126.96.36.199, Antiy Labs AVL SDK
188.8.131.52, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus
10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00,
ClamAV 0.96.4, Command Antivirus 184.108.40.206, Emsisoft Anti-Malware
220.127.116.11, eSafe 18.104.22.168, F-Prot Antivirus 22.214.171.124, G Data AntiVirus
21, Ikarus Virus Utilities T3 Command Line Scanner 126.96.36.199, Jiangmin
Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus
188.8.131.52, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee
Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in
Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman
Antivirus 6.06.12, PC Tools AntiVirus 184.108.40.206, Rising Antivirus
22.83.00.03, AVEngine 20220.127.116.11 in Symantec Endpoint Protection
11, Trend Micro AntiVirus 18.104.22.1684, Trend Micro HouseCall
22.214.171.1244, VBA32 126.96.36.199, and VirusBuster 188.8.131.52 allows
remote attackers to bypass malware detection via a TAR archive entry
with a length field that exceeds the total TAR file size. NOTE: this
may later be SPLIT into multiple CVEs if additional information is
published showing that the error occurred independently in different
TAR parser implementations.
Created clamav tracking bugs for this issue
Affects: fedora-all [bug 806102]
Affects: epel-all [bug 806103]
The upstream bug for this flaw is here:
Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present.
clamav-0.97.5-1700.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1600.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.