CVE-2009-1348
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security,...
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
Exploit likelihood
What each source reports
NVD Score used
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
- Record
CVE-2009-1348- CVSS 2.0
- 7.6 High
AV:N/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
- Record
CVE-2009-1348- Updated
- 2026-11-02
EUVDEUVD-2009-1346 No score
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
- Record
EUVD-2009-1346- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-72mq-5g76-mmq5 No score
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security,...
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
- Record
GHSA-72mq-5g76-mmq5- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- mcafee active virus defense
- mcafee email gateway
- mcafee securityshield for microsoft isa server
- mcafee total protection
- mcafee active virusscan
- mcafee internet security suite
- mcafee securityshield for email servers
- mcafee securityshield for microsoft sharepoint
- mcafee total protection for endpoint
- mcafee virusscan commandline
- mcafee virusscan enterprise
- mcafee virusscan plus
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1348 is a high vulnerability (CVSS 7.6) in Mcafee Active Virus Defense, published April 30, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/503173/100/0/threaded
kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
secunia.com/advisories/34949
blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
nvd.nist.gov/vuln/detail/CVE-2009-1348
github.com/advisories/GHSA-72mq-5g76-mmq5