Vulnerability record · CVE-2012-1445 · published 21 March 2012
CVE-2012-1445: Antivirus ELF parser malware detection bypass via modified abi field
Aladdin · Esafe
The ELF file parser in eSafe, Rising Antivirus, Fortinet Antivirus and Panda Antivirus can be tricked into misreading an ELF file when its abi field is modified, allowing malware to evade detection. Because the affected component is the scanner itself, a bypass undermines the core protection these products provide. The record notes the issue may later be split if the error proves independent across parser implementations.
Description
The ELF file parser in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified abi field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations.
AV:N/AC:M/Au:N/C:N/I:P/A:N
Automated analysis
medium priorityCVSS 2.0 scores it 4.3 (MEDIUM) with integrity-only impact, but the high EPSS and the fact that it defeats antivirus detection raise defensive concern.
What it is
The ELF file parser in eSafe, Rising Antivirus, Fortinet Antivirus and Panda Antivirus can be tricked into misreading an ELF file when its abi field is modified, allowing malware to evade detection. Because the affected component is the scanner itself, a bypass undermines the core protection these products provide. The record notes the issue may later be split if the error proves independent across parser implementations.
Impact
An attacker can deliver a malicious ELF file that the affected antivirus engine fails to flag, letting malware reach a host that otherwise relies on that scanner. The direct gain is evasion of detection, not code execution or data access on its own.
Attack surface
The flaw is reached remotely by supplying a crafted ELF file to the scanning engine, for example through file transfer, email attachment or on-access scanning. No authentication is required, though the CVSS vector indicates medium attack complexity and no user interaction is specified.
Exploitation
No CISA KEV listing and no reference tags indicating public exploit code; EPSS is very high (0.89938, 99.786th percentile), suggesting elevated predicted exploitation activity despite the absence of confirmed in-the-wild use.
What to do
- Apply vendor updates for eSafe, Rising Antivirus, Fortinet Antivirus and Panda Antivirus; if no fix exists, treat these versions as unable to reliably detect crafted ELF files.
- Layer a second, independent detection engine or sandbox for ELF files rather than relying on a single affected scanner.
- Block or quarantine ELF files at email and web gateways where they are not operationally required.
- Monitor vendor advisories for the possible split of this CVE into per-product identifiers and track each separately.
Detection
- Hunt for ELF files with unusual or modified abi field values reaching endpoints or mail gateways.
- Correlate scanner logs for ELF files that pass clean but later execute or trigger endpoint alerts.
- Alert on ELF file transfers to hosts that do not normally handle Linux binaries.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-1445 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-1445), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
