Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Quick Heal and similar antiviruses can miss crafted TAR malware

CVE-2012-1426 · published 14 years ago
Summary

The TAR file handling code in Quick Heal, Command Antivirus, F‑Prot Antivirus, K7 AntiVirus, Norman Antivirus and Rising Antivirus can be tricked by a specially formed archive, letting malicious software go undetected. This means a attacker could hide malware inside such a file and bypass the scanner. Update the products to the latest versions or apply the vendor's recommended patch to restore proper detection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
authentium command_antivirus 5.2.11.5
cpe:2.3:a:authentium:command_antivirus:5.2.11.5:*:*:*:*:*:*:*
cat quick_heal 11.00
cpe:2.3:a:cat:quick_heal:11.00:*:*:*:*:*:*:*
f-prot f-prot_antivirus 4.6.2.117
cpe:2.3:a:f-prot:f-prot_antivirus:4.6.2.117:*:*:*:*:*:*:*
k7computing antivirus 9.77.3565
cpe:2.3:a:k7computing:antivirus:9.77.3565:*:*:*:*:*:*:*
norman norman_antivirus_\&_antispyware 6.06.12
cpe:2.3:a:norman:norman_antivirus_\&_antispyware:6.06.12:*:*:*:*:*:*:*
rising-global rising_antivirus 22.83.00.03
cpe:2.3:a:rising-global:rising_antivirus:22.83.00.03:*:*:*:*:*:*:*
Original advisory text
The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, K7 AntiVirus 9.77.3565, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00....
The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, K7 AntiVirus 9.77.3565, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \42\5A\68 character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
90% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published21 Mar 2012
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-1426 · NVD
Track software like this
Free during beta