CVE-2004-0932: High severity Archive Zip Archive Zip vulnerability

Published Nov 19, 2004

Updated

McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 October 6th 2004 allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Affected Software

48 affected components

Archive Zip Archive Zip=1.13

Broadcom Brightstor Arcserve Backup=11.1

Broadcom Etrust Antivirus=7.0

Broadcom Etrust Antivirus=7.1

Broadcom Etrust Antivirus Gateway=7.0

Broadcom Etrust Antivirus Gateway=7.1

Broadcom Etrust Ez Antivirus=6.1

Broadcom Etrust Ez Antivirus=6.2

Broadcom Etrust Ez Antivirus=6.3

Broadcom Etrust Ez Armor=2.0

Broadcom Etrust Ez Armor=2.3

Broadcom Etrust Ez Armor=2.4

Broadcom Etrust Intrusion Detection=1.4.1.13

Broadcom Etrust Intrusion Detection=1.4.5

Broadcom Etrust Intrusion Detection=1.5

Broadcom Etrust Secure Content Manager=1.0

Broadcom Etrust Secure Content Manager=1.1

Broadcom Inoculateit=6.0

CA eTrust Antivirus=7.0_sp2

CA eTrust Secure Content Manager=1.0-sp1

Eset Software Nod32 Antivirus=1.0.11

Eset Software Nod32 Antivirus=1.0.12

Eset Software Nod32 Antivirus=1.0.13

Kaspersky Lab Kaspersky Anti-virus=3.0

Kaspersky Lab Kaspersky Anti-virus=4.0

Kaspersky Lab Kaspersky Anti-virus=5.0

McAfee Antivirus Engine=4.3.20

RAV antivirus Rav Antivirus Desktop=8.6

RAV antivirus Rav Antivirus For File Servers=1.0

RAV antivirus Rav Antivirus For Mail Servers=8.4.2

Sophos Sophos Anti-Virus=3.4.6

Sophos Sophos Anti-Virus=3.78

Sophos Sophos Anti-Virus=3.78d

Sophos Sophos Anti-Virus=3.79

Sophos Sophos Anti-Virus=3.80

Sophos Sophos Anti-Virus=3.81

Sophos Sophos Anti-Virus=3.82

Sophos Sophos Anti-Virus=3.83

Sophos Sophos Anti-Virus=3.84

Sophos Sophos Anti-Virus=3.85

Sophos Sophos Anti-Virus=3.86

Sophos Sophos Puremessage Anti-virus=4.6

Sophos Sophos Small Business Suite=1.0

Gentoo Linux

Gentoo Linux=1.4

Mandrakesoft Mandrake Linux=10.1

SUSE SuSE Linux=9.2

Remediation

Patch Available

http://www.securityfocus.com/bid/11448

Event History

Nov 19, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0932?

The severity of CVE-2004-0932 is considered high due to its potential to allow remote attackers to bypass antivirus protection.

How do I fix CVE-2004-0932?

To fix CVE-2004-0932, update your antivirus software to versions that are released after October 13, 2004, which address this vulnerability.

Which software is affected by CVE-2004-0932?

CVE-2004-0932 affects various antivirus software including McAfee Antivirus Engine, Kaspersky Anti-Virus, and Sophos Anti-Virus among others.

What types of attacks can exploit CVE-2004-0932?

CVE-2004-0932 can be exploited through specially crafted compressed files that bypass antivirus scans.

When was CVE-2004-0932 discovered?

CVE-2004-0932 was discovered and reported in 2004, specifically around October.