CVE-2020-9362 Security feature bypass in n/a
Attackers can bypass virus detection in Quick Heal AV by crafting a specific ZIP archive flag, allowing malicious files to evade scanning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-9362?
CVE-2020-9362 is a high-severity vulnerability in n/a, published on 24 Feb 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Security, Total Security Multi-Device, Internet Security, Total Security for Mac, AntiVirus Pro, AntiVirus for Server, and Total Security for Android.
Weakness: CWE-436
Which versions are affected by CVE-2020-9362?
It affects 6 products.
Products include Quickheal Antivirus for Server, Quickheal Antivirus Pro, Quickheal Home Security, Quickheal Internet Security, Quickheal Total Security, Quickheal Total Security Multi-Device.
How do I fix CVE-2020-9362?
No fix has been published for CVE-2020-9362 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9362 being exploited?
There is no known exploitation of CVE-2020-9362 in the wild and no public exploit code.
Sources
Also known as GHSA-f7j2-6v4c-hjxw.