CVE-2004-1096

Current Description

Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

Basic Data

Published	January 10, 2005
Last Modified	July 11, 2017
Assigner	cve@mitre.org
Data Type	CVE
Data Format	MITRE
Data Version	4.0
Problem Type	NVD-CWE-Other
CVE Data Version	4.0

Base Metric V2

CVSS 2 - Version	2.0
CVSS 2 - Vector String	AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 2 - Access Vector	NETWORK
CVSS 2 - Access Complexity	LOW
CVSS 2 - Authentication	NONE
CVSS 2 - Confidentiality Impact	PARTIAL
CVSS 2 - Availability Impact	PARTIAL
CVSS 2 - Base Score	7.5
Severity	HIGH
Exploitability Score	10.0
Impact Score	6.4
Obtain All Privilege	false
Obtain User Privilege	false
Obtain Other Privilege	true

Base Metric V3

No data provided.

Configurations

OR - Configuration 1

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	Application	Ca	Brightstor Arcserve Backup	11.1	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Antivirus	7.0	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Antivirus	7.0_sp2	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Antivirus	7.1	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Antivirus Gateway	7.0	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Antivirus Gateway	7.1	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Ez Antivirus	6.1	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Ez Antivirus	6.2	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Ez Antivirus	6.3	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Ez Armor	2.0	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Ez Armor	2.3	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Ez Armor	2.4	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Intrusion Detection	1.4.1.13	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Intrusion Detection	1.4.5	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Intrusion Detection	1.5	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Secure Content Manager	1.0	*	*	*	*	*	*	*
2.3	Application	Ca	Etrust Secure Content Manager	1.0	sp1	*	*	*	*	*	*
2.3	Application	Ca	Etrust Secure Content Manager	1.1	*	*	*	*	*	*	*
2.3	Application	Ca	Inoculateit	6.0	*	*	*	*	*	*	*
2.3	Application	Eset Software	Nod32 Antivirus	1.0.11	*	*	*	*	*	*	*
2.3	Application	Eset Software	Nod32 Antivirus	1.0.12	*	*	*	*	*	*	*
2.3	Application	Eset Software	Nod32 Antivirus	1.0.13	*	*	*	*	*	*	*
2.3	Application	Kaspersky Lab	Kaspersky Anti-virus	3.0	*	*	*	*	*	*	*
2.3	Application	Kaspersky Lab	Kaspersky Anti-virus	4.0	*	*	*	*	*	*	*
2.3	Application	Kaspersky Lab	Kaspersky Anti-virus	5.0	*	*	*	*	*	*	*
2.3	Application	Mcafee	Antivirus Engine	4.3.20	*	*	*	*	*	*	*
2.3	Application	Rav Antivirus	Rav Antivirus Desktop	8.6	*	*	*	*	*	*	*
2.3	Application	Rav Antivirus	Rav Antivirus For File Servers	1.0	*	*	*	*	*	*	*
2.3	Application	Rav Antivirus	Rav Antivirus For Mail Servers	8.4.2	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.4.6	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.78	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.78d	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.79	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.80	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.81	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.82	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.83	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.84	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.85	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Anti-virus	3.86	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Puremessage Anti-virus	4.6	*	*	*	*	*	*	*
2.3	Application	Sophos	Sophos Small Business Suite	1.0	*	*	*	*	*	*	*

OR - Configuration 2

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other
2.3	OS	Gentoo	Linux	*	*	*	*	*	*	*	*
2.3	OS	Gentoo	Linux	1.4	*	*	*	*	*	*	*
2.3	OS	Mandrakesoft	Mandrake Linux	10.1	*	*	*	*	*	*	*
2.3	OS	Mandrakesoft	Mandrake Linux	10.1	*	x86_64	*	*	*	*	*
2.3	OS	Suse	Suse Linux	9.2	*	*	*	*	*	*	*

Vulnerable Software List

Vendor	Product	Versions
Kaspersky Lab	Kaspersky Anti-virus	3.0, 4.0, 5.0
Ca	Etrust Intrusion Detection	1.4.1.13, 1.4.5, 1.5
Ca	Inoculateit	6.0
Ca	Brightstor Arcserve Backup	11.1
Ca	Etrust Antivirus	7.0, 7.0_sp2, 7.1
Ca	Etrust Antivirus Gateway	7.0, 7.1
Ca	Etrust Ez Antivirus	6.1, 6.2, 6.3
Ca	Etrust Ez Armor	2.0, 2.3, 2.4
Ca	Etrust Secure Content Manager	1.0, 1.1
Sophos	Sophos Anti-virus	3.4.6, 3.78, 3.78d, 3.79, 3.80, 3.81, 3.82, 3.83, 3.84, 3.85, 3.86
Sophos	Sophos Puremessage Anti-virus	4.6
Sophos	Sophos Small Business Suite	1.0
Rav Antivirus	Rav Antivirus For Mail Servers	8.4.2
Rav Antivirus	Rav Antivirus Desktop	8.6
Rav Antivirus	Rav Antivirus For File Servers	1.0
Mandrakesoft	Mandrake Linux	10.1
Mcafee	Antivirus Engine	4.3.20
Eset Software	Nod32 Antivirus	1.0.11, 1.0.12, 1.0.13
Suse	Suse Linux	9.2
Gentoo	Linux	*, 1.4

References

Name	Source	URL	Tags
13038	http://secunia.com/advisories/13038/	SECUNIA
GLSA-200410-31	http://www.gentoo.org/security/en/glsa/glsa-200410-31.xml	GENTOO	Patch Vendor Advisory
20041018 Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability	http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities&flashstatus=true	IDEFENSE	Vendor Advisory
VU#492545	http://www.kb.cert.org/vuls/id/492545	CERT-VN	US Government Resource
MDKSA-2004:118	http://www.mandriva.com/security/advisories?name=MDKSA-2004:118	MANDRAKE
11448	http://www.securityfocus.com/bid/11448	BID	Exploit Patch Vendor Advisory
antivirus-zip-protection-bypass(17761)	https://exchange.xforce.ibmcloud.com/vulnerabilities/17761	XF