ID CVE-2005-3382
Summary Multiple interpretation error in Sophos 3.91 with the 2.28.4 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
References
Vulnerable Configurations
  • cpe:2.3:a:sophos:sophos_anti-virus:3.91_engine_2.28.4:*:*:*:*:*:*:*
    cpe:2.3:a:sophos:sophos_anti-virus:3.91_engine_2.28.4:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 18-10-2016 - 03:35)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
refmap via4
bid 15189
bugtraq 20051025 Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through
misc
Last major update 18-10-2016 - 03:35
Published 30-10-2005 - 14:34
Last modified 18-10-2016 - 03:35
Back to Top