What’s Vulnerable › Vulnerabilities

CVE-2009-1348

• Severity: high (CVSS 7.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-04-30 · updated 2026-06-16
• Weakness: CWE-20

Description

The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.

Affected products

• McAfee Active Virus Defense: all versions
• McAfee Active Virusscan: all versions
• Intel McAfee Email Gateway (MEG): all versions
• McAfee Internet Security Suite: 2004, 2005, 2006, 2009
• McAfee Securityshield For Email Servers: all versions
• McAfee Securityshield For Microsoft Isa Server: all versions
• McAfee Securityshield For Microsoft Sharepoint: all versions
• McAfee,LLC McAfee Total Protection (MTP): 2009
• McAfee Total Protection For Endpoint: all versions
• McAfee Virusscan Commandline: all versions
• Intel VirusScan Enterprise Linux (VSEL): all versions
• McAfee Virusscan Plus: 2009
• McAfee Virusscan Usb: all versions

References

• http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
• http://secunia.com/advisories/34949
• http://www.securityfocus.com/archive/1/503173/100/0/threaded
• http://www.securityfocus.com/bid/34780
• https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
• http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
• http://secunia.com/advisories/34949
• http://www.securityfocus.com/archive/1/503173/100/0/threaded
• http://www.securityfocus.com/bid/34780
• https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT

Get alerted when CVE-2009-1348 or the next vulnerability affects your stack