PatchTheCVECVE-2004-0936: RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and
55
This week
HIGH 7.5DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2004-0936 is a high-severity flaw (CVSS 7.5) affecting archive zip, brightstor arcserve backup, etrust antivirus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.5 (High) |
| EPSS exploit chance | 14.9% (top 3%) |
| CISA exploited list | No |
| Published | 2005-01-27 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
archive zip archive zip DOWNGRADE
Affected: 1.13
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.13
1. Check installed version
apt-cache policy archive-zip || rpm -q archive-zip || archive-zip --version
2. No fixed release: DOWNGRADE to a release before 1.13 (Debian / Ubuntu)
apt-cache madison archive-zip
sudo apt install archive-zip=<VERSION_BEFORE_1.13>
sudo apt-mark hold archive-zip
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list archive-zip
sudo dnf downgrade archive-zip-<VERSION_BEFORE_1.13>
sudo dnf versionlock add archive-zip
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom brightstor arcserve backup DOWNGRADE
Affected: 11.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.1
1. Check installed version
apt-cache policy brightstor-arcserve-backup || rpm -q brightstor-arcserve-backup || brightstor-arcserve-backup --version
2. No fixed release: DOWNGRADE to a release before 11.1 (Debian / Ubuntu)
apt-cache madison brightstor-arcserve-backup
sudo apt install brightstor-arcserve-backup=<VERSION_BEFORE_11.1>
sudo apt-mark hold brightstor-arcserve-backup
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list brightstor-arcserve-backup
sudo dnf downgrade brightstor-arcserve-backup-<VERSION_BEFORE_11.1>
sudo dnf versionlock add brightstor-arcserve-backup
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom etrust antivirus DOWNGRADE
Affected: 7.0 · 7.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0
1. Check installed version
apt-cache policy etrust-antivirus || rpm -q etrust-antivirus || etrust-antivirus --version
2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)
apt-cache madison etrust-antivirus
sudo apt install etrust-antivirus=<VERSION_BEFORE_7.0>
sudo apt-mark hold etrust-antivirus
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list etrust-antivirus
sudo dnf downgrade etrust-antivirus-<VERSION_BEFORE_7.0>
sudo dnf versionlock add etrust-antivirus
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom etrust antivirus gateway DOWNGRADE
Affected: 7.0 · 7.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0
1. Check installed version
apt-cache policy etrust-antivirus-gateway || rpm -q etrust-antivirus-gateway || etrust-antivirus-gateway --version
2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)
apt-cache madison etrust-antivirus-gateway
sudo apt install etrust-antivirus-gateway=<VERSION_BEFORE_7.0>
sudo apt-mark hold etrust-antivirus-gateway
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list etrust-antivirus-gateway
sudo dnf downgrade etrust-antivirus-gateway-<VERSION_BEFORE_7.0>
sudo dnf versionlock add etrust-antivirus-gateway
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom etrust ez antivirus DOWNGRADE
Affected: 6.1 · 6.2 · 6.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.1
1. Check installed version
apt-cache policy etrust-ez-antivirus || rpm -q etrust-ez-antivirus || etrust-ez-antivirus --version
2. No fixed release: DOWNGRADE to a release before 6.1 (Debian / Ubuntu)
apt-cache madison etrust-ez-antivirus
sudo apt install etrust-ez-antivirus=<VERSION_BEFORE_6.1>
sudo apt-mark hold etrust-ez-antivirus
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list etrust-ez-antivirus
sudo dnf downgrade etrust-ez-antivirus-<VERSION_BEFORE_6.1>
sudo dnf versionlock add etrust-ez-antivirus
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom etrust ez armor DOWNGRADE
Affected: 2.0 · 2.3 · 2.4
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy etrust-ez-armor || rpm -q etrust-ez-armor || etrust-ez-armor --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison etrust-ez-armor
sudo apt install etrust-ez-armor=<VERSION_BEFORE_2.0>
sudo apt-mark hold etrust-ez-armor
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list etrust-ez-armor
sudo dnf downgrade etrust-ez-armor-<VERSION_BEFORE_2.0>
sudo dnf versionlock add etrust-ez-armor
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: Multiple AntiVirus - '.zip' Detection Bypass
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2004-0936?
archive zip: downgrade or apply the listed mitigation; brightstor arcserve backup: downgrade or apply the listed mitigation; etrust antivirus: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2004-0936 being exploited?
CVE-2004-0936 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2004-0936 affect?
CVE-2004-0936 affects archive zip, brightstor arcserve backup, etrust antivirus. Severity is high (CVSS 7.5). RAV antivirus allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
How urgent is CVE-2004-0936?
Priority 55/100. High severity; EPSS top 3%: very likely to be exploited; Public exploit reference
Related CVEs
- CVE-2004-0937 HIGH 7.5 DOWNGRADE DOWNGRADE Sophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote
- CVE-2004-0935 HIGH 7.5 DOWNGRADE DOWNGRADE Eset Anti-Virus before 1.020 (16th September 2004) allows remote attackers to bypass antivirus protection via
- CVE-2004-0934 HIGH 7.5 DOWNGRADE DOWNGRADE Kaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both lo
- CVE-2004-0933 HIGH 7.5 DOWNGRADE DOWNGRADE Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway
- CVE-2004-0932 HIGH 7.5 DOWNGRADE DOWNGRADE McAfee Anti-Virus Engine DATS drivers before 4398 released on Oct 13th 2004 and DATS Driver before 4397 Octobe