CVE-2012-1463

AhnLab V3 Internet Security 2011.01.18.00 - Malware Detection Bypass via ELF Endianness Field

Title source: llm

Description

The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified endianness field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/522005

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/80433

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/52614

Various Sources x_refsource_misc

http://www.ieee-security.org/TC/SP2012/program.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/80426

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/74311

Scores

EPSS 0.0097

EPSS Percentile 76.9%

Details

CWE

CWE-264

Status published

Products (12)

ahnlab/v3_internet_security 2011.01.18.00

aladdin/esafe 7.0.17.0

authentium/command_antivirus 5.2.11.5

bitdefender/bitdefender 7.2

cat/quick_heal 11.00

comodo/comodo_antivirus 7424

f-prot/f-prot_antivirus 4.6.2.117

f-secure/f-secure_anti-virus 9.0.16160.0

mcafee/scan_engine 5.400.0.1158

norman/norman_antivirus_\&_antispyware 6.06.12

... and 2 more

Published Mar 21, 2012

Tracked Since Feb 18, 2026