ZIP Archive Parsing Vulnerability in Avast Antivirus Products
CVE-2020-9399

5.5MEDIUM

Key Information:

Vendor

Avast

Status
Antivirus For Linux
Antivirus Pro Plus
Antivirus Pro
Vendor
CVE Published:
28 February 2020

What is CVE-2020-9399?

A vulnerability in the Avast Antivirus parsing engine could allow malicious actors to bypass virus detection by utilizing specially crafted ZIP archives. This impacts users of Avast Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux with versions prior to 12 definitions 200114-0. As a result, attackers could exploit this weakness to deliver malicious payloads undetected, posing a significant risk to the security of systems relying on these antivirus solutions.

References

https://blog.zoller.lu/p/tzo-23-2020-avast-generic-archiv...
x_refsource_MISC
https://seclists.org/fulldisclosure/2020/Feb/35
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.