CVE-2012-1447
The ELF file parser in Fortinet Antivirus 4.2.254.0, eSafe 7.0.17.0, Dr.Web 5.0.2.03300, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified e_version field.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 67.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
The ELF file parser in Fortinet Antivirus 4.2.254.0, eSafe 7.0.17.0, Dr.Web 5.0.2.03300, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified e_version field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 67.66% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- aladdin/esafe · drweb/dr.web antivirus · fortinet/fortinet antivirus · pandasecurity/panda antivirus
- Source
- cve@mitre.org
References
- http://osvdb.org/80432
- http://www.ieee-security.org/TC/SP2012/program.html
- http://www.securityfocus.com/archive/1/522005
- http://www.securityfocus.com/bid/52601
- http://osvdb.org/80432
- http://www.ieee-security.org/TC/SP2012/program.html
- http://www.securityfocus.com/archive/1/522005
- http://www.securityfocus.com/bid/52601
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.