iDEFENSE Security Advisory 10.18.04:
This vulnerability affects multiple anti-virus vendors including McAfee, Computer Associates, Kaspersky, Sophos, Eset and RAV.
II. DESCRIPTION
Remote exploitation of an exceptional condition error in multiple vendors’ anti-virus software allows attackers to bypass security protections by evading virus detection.
The problem specifically exists in the parsing of .zip archive headers. The .zip file format stores information about compressed files in two locations - a local header and a global header. The local header exists just before the compressed data of each file, and the global header exists at the end of the .zip archive. It is possible to modify the uncompressed size of archived files in both the local and global header without affecting functionality. This has been confirmed with both WinZip and Microsoft Compressed Folders. An attacker can compress a malicious payload and evade detection by some anti-virus software by modifying the uncompressed size within the local and global headers to zero.
Just wondering if Avast is covered for this threat
Reference:
h**p://www.idefense.com/application/poi/display?id=153&type=vulnerabilities