CVE-2012-1431
What it is
The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
At a glance
- Exploitability
- Can be exploited over the network without logging in. Limited direct impact.
- Exploit odds
- 99.5% chance of exploitation in the next 30 days (EPSS). Higher than most.
- Fix
- No patch or advisory is linked yet. Look at mitigations or restrict exposure.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 99.5% in the next 30 days (EPSS).
- Severity: 4.3 MEDIUM (CVSS).
- Fix: none linked yet, which raises it.
Details
- Published
- Last modified
- Exploit probability
- 99.5% · EPSS, next 30 days
- Weakness
- CWE-264
- Record status
- Modified
Affected
- Aladdin Esafe 7.0.17.0
- Authentium Command Antivirus 5.2.11.5
- Bitdefender 7.2
- Comodo Antivirus 7424
- f-prot Antivirus 4.6.2.117
- f-secure anti-virus 9.0.16160.0
- Mcafee Gateway 2010.1c
- Nprotect Antivirus 2011-01-17.01
Attack profile CVSS 2.0 · 4.3
- Attack vector
- Network
- Complexity
- Medium
- Authentication
- None
- Confidentiality
- None
- Integrity
- Partial
- Availability
- None
Raw vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2012-1431.md and follow it. Check whether this project is affected by CVE-2012-1431. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
