Red Hat Bugzilla – Bug 806101
CVE-2012-1459 clamav: specially-crafted length field in tar files evade detection
Last modified: 2013-01-29 17:58:15 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1459 to
the following vulnerability:
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00,
Avira AntiVir 22.214.171.124, Antiy Labs AVL SDK 126.96.36.199, avast! Antivirus
4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2,
Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus
188.8.131.52, Comodo Antivirus 7424, Emsisoft Anti-Malware 184.108.40.206, F-Prot
Antivirus 220.127.116.11, F-Secure Anti-Virus 9.0.16160.0, Fortinet
Antivirus 18.104.22.168, G Data AntiVirus 21, Ikarus Virus Utilities T3
Command Line Scanner 22.214.171.124, Jiangmin Antivirus 13.0.900, K7
AntiVirus 9.77.3565, Kaspersky Anti-Virus 126.96.36.199, McAfee Anti-Virus
Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher)
2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security
Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12,
nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools
AntiVirus 188.8.131.52, Rising Antivirus 22.83.00.03, Sophos Anti-Virus
4.61.0, AVEngine 20184.108.40.206 in Symantec Endpoint Protection 11,
Trend Micro AntiVirus 220.127.116.114, Trend Micro HouseCall
18.104.22.1684, VBA32 22.214.171.124, and VirusBuster 126.96.36.199 allows
remote attackers to bypass malware detection via a TAR archive entry
with a length field corresponding to that entire entry, plus part of
the header of the next entry. NOTE: this may later be SPLIT into
multiple CVEs if additional information is published showing that the
error occurred independently in different TAR parser implementations.
Created clamav tracking bugs for this issue
Affects: fedora-all [bug 806102]
Affects: epel-all [bug 806103]
The upstream bug for this flaw is here:
Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present.
clamav-0.97.5-1700.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1600.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.