Vulnerability Details : CVE-2018-7289
An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters.
Products affected by CVE-2018-7289
- cpe:2.3:a:teclib-edition:armadito_antivirus:0.12.7.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-7289
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-7289
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
3.3
|
LOW | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
1.8
|
1.4
|
NIST |
CWE ids for CVE-2018-7289
-
The product does not properly encode or decode the data, resulting in unexpected values.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-7289
-
https://github.com/armadito/armadito-windows-driver/issues/5
Malware with pure UTF-16 characters in the filename can bypass detection · Issue #5 · armadito/armadito-windows-driver · GitHubThird Party Advisory
-
https://www.exploit-db.com/exploits/44169/
Armadito Antivirus 0.12.7.2 - Detection BypassExploit;Third Party Advisory;VDB Entry
Jump to