PatchTheCVECVE-2009-3588: Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise
36
Routine
MEDIUM 4.3DOWNGRADEDOWNGRADEMITIGATE
CVE-2009-3588 is a medium-severity flaw (CVSS 4.3) affecting anti-virus, anti-virus for the enterprise, anti-virus sdk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.3 (Medium) |
| EPSS exploit chance | 2.4% (top 16%) |
| CISA exploited list | No |
| Published | 2009-10-13 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
broadcom anti-virus DOWNGRADE
Affected: 2007 8 · 2008
Fixed in: no fixed release known
Safe to downgrade to: a release before 2007
1. Check installed version
apt-cache policy anti-virus || rpm -q anti-virus || anti-virus --version
2. No fixed release: DOWNGRADE to a release before 2007 (Debian / Ubuntu)
apt-cache madison anti-virus
sudo apt install anti-virus=<VERSION_BEFORE_2007>
sudo apt-mark hold anti-virus
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list anti-virus
sudo dnf downgrade anti-virus-<VERSION_BEFORE_2007>
sudo dnf versionlock add anti-virus
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom anti-virus for the enterprise DOWNGRADE
Affected: 7.1 · r8
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.1
1. Check installed version
apt-cache policy anti-virus-for-the-enterprise || rpm -q anti-virus-for-the-enterprise || anti-virus-for-the-enterprise --version
2. No fixed release: DOWNGRADE to a release before 7.1 (Debian / Ubuntu)
apt-cache madison anti-virus-for-the-enterprise
sudo apt install anti-virus-for-the-enterprise=<VERSION_BEFORE_7.1>
sudo apt-mark hold anti-virus-for-the-enterprise
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list anti-virus-for-the-enterprise
sudo dnf downgrade anti-virus-for-the-enterprise-<VERSION_BEFORE_7.1>
sudo dnf versionlock add anti-virus-for-the-enterprise
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom anti-virus sdk MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy anti-virus-sdk || rpm -q anti-virus-sdk || anti-virus-sdk --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
broadcom common services DOWNGRADE
Affected: 11 · 11.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 11
1. Check installed version
apt-cache policy common-services || rpm -q common-services || common-services --version
2. No fixed release: DOWNGRADE to a release before 11 (Debian / Ubuntu)
apt-cache madison common-services
sudo apt install common-services=<VERSION_BEFORE_11>
sudo apt-mark hold common-services
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list common-services
sudo dnf downgrade common-services-<VERSION_BEFORE_11>
sudo dnf versionlock add common-services
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom etrust antivirus DOWNGRADE
Affected: 7.1 · 8 · 8.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.1
1. Check installed version
apt-cache policy etrust-antivirus || rpm -q etrust-antivirus || etrust-antivirus --version
2. No fixed release: DOWNGRADE to a release before 7.1 (Debian / Ubuntu)
apt-cache madison etrust-antivirus
sudo apt install etrust-antivirus=<VERSION_BEFORE_7.1>
sudo apt-mark hold etrust-antivirus
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list etrust-antivirus
sudo dnf downgrade etrust-antivirus-<VERSION_BEFORE_7.1>
sudo dnf versionlock add etrust-antivirus
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
broadcom etrust integrated threat management DOWNGRADE
Affected: 8.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.1
1. Check installed version
apt-cache policy etrust-integrated-threat-management || rpm -q etrust-integrated-threat-management || etrust-integrated-threat-management --version
2. No fixed release: DOWNGRADE to a release before 8.1 (Debian / Ubuntu)
apt-cache madison etrust-integrated-threat-management
sudo apt install etrust-integrated-threat-management=<VERSION_BEFORE_8.1>
sudo apt-mark hold etrust-integrated-threat-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list etrust-integrated-threat-management
sudo dnf downgrade etrust-integrated-threat-management-<VERSION_BEFORE_8.1>
sudo dnf versionlock add etrust-integrated-threat-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2009-3588?
anti-virus: downgrade or apply the listed mitigation; anti-virus for the enterprise: downgrade or apply the listed mitigation; anti-virus sdk: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2009-3588 being exploited?
CVE-2009-3588 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2009-3588 affect?
CVE-2009-3588 affects anti-virus, anti-virus for the enterprise, anti-virus sdk. Severity is medium (CVSS 4.3). Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suit
How urgent is CVE-2009-3588?
Priority 36/100. No elevated risk signals yet.
Related CVEs
- CVE-2023-1587 MEDIUM 5.8 UPGRADE UPGRADE Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface
- CVE-2023-1586 MEDIUM 6.5 UPGRADE UPGRADE Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in
- CVE-2023-1585 MEDIUM 6.5 UPGRADE UPGRADE Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in
- CVE-2023-1453 MEDIUM 4.4 DOWNGRADE A vulnerability was found in Watchdog Anti-Virus 1.4.214.0
- CVE-2023-1446 MEDIUM 5.5 DOWNGRADE A vulnerability classified as problematic was found in Watchdog Anti-Virus 1.4.214.0