CVE-2012-1446
First published: Wed Mar 21 2012(Updated: )
The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman Antivirus 6.06.12, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, McAfee Gateway (formerly Webwasher) 2010.1C, Sophos Anti-Virus 4.61.0, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified encoding field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Aladdin eSafe | =7.0.17.0 | |
| Antiy AVL SDK | =2.0.3.7 | |
| CA eTrust Vet Antivirus | =36.1.8511 | |
| QuickHeal CAT QuickHeal | =11.00 | |
| Fortinet Antivirus | =4.2.254.0 | |
| Kaspersky Anti-Virus | =7.0.0.125 | |
| McAfee Gateway | =2010.1c | |
| McAfee Scan Engine | =5.400.0.1158 | |
| Norman Antivirus & Antispyware | =6.06.12 | |
| Panda Security | =10.0.2.7 | |
| PC Tools Antivirus | =7.0.3.5 | |
| Rising Antivirus | =22.83.00.03 | |
| Sophos Anti-Virus | =4.61.0 | |
| Symantec Endpoint Protection | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-1446?
CVE-2012-1446 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2012-1446?
To fix CVE-2012-1446, update your anti-virus software to the latest version that addresses this vulnerability.
Which software is affected by CVE-2012-1446?
CVE-2012-1446 affects various software including McAfee, Kaspersky, Symantec Endpoint Protection, and QuickHeal among others.
What type of vulnerability is CVE-2012-1446?
CVE-2012-1446 is an arbitrary code execution vulnerability that arises from flaws in the ELF file parser.
How can I know if my system is vulnerable to CVE-2012-1446?
You can determine if your system is vulnerable to CVE-2012-1446 by checking whether you are using any of the affected anti-virus software versions.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/aladdin
- canonical/aladdin esafe
- version/aladdin esafe/7.0.17.0
- vendor/antiy
- canonical/antiy avl sdk
- version/antiy avl sdk/2.0.3.7
- vendor/ca
- canonical/ca etrust vet antivirus
- version/ca etrust vet antivirus/36.1.8511
- vendor/cat
- canonical/quickheal cat quickheal
- version/quickheal cat quickheal/11.00
- vendor/fortinet
- canonical/fortinet antivirus
- version/fortinet antivirus/4.2.254.0
- vendor/kaspersky
- canonical/kaspersky anti-virus
- version/kaspersky anti-virus/7.0.0.125
- vendor/mcafee
- canonical/mcafee gateway
- version/mcafee gateway/2010.1c
- canonical/mcafee scan engine
- version/mcafee scan engine/5.400.0.1158
- vendor/norman
- canonical/norman antivirus & antispyware
- version/norman antivirus & antispyware/6.06.12
- vendor/pandasecurity
- canonical/panda security
- version/panda security/10.0.2.7
- vendor/pc tools
- canonical/pc tools antivirus
- version/pc tools antivirus/7.0.3.5
- vendor/rising-global
- canonical/rising antivirus
- version/rising antivirus/22.83.00.03
- vendor/sophos
- canonical/sophos anti-virus
- version/sophos anti-virus/4.61.0
- vendor/symantec
- canonical/symantec endpoint protection
- version/symantec endpoint protection/11.0