PT-2005-4172 · Doctor Web · Dr.Web

Andrey Bayora · Publicado 2005-10-29 · Atualizado 2016-10-18 · CVE-2005-3373

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dr.Web version 4.32b

Description The issue allows remote attackers to bypass virus scanning by manipulating files with specific magic byte sequences, such as "MZ", which is typically associated with EXE files. This can cause certain file types, like BAT, HTML, and EML, to be treated as safe when they could still be executed as dangerous file types by applications on the end system. An example of exploitation is a "triple headed" program containing EXE, EML, and HTML content.

Recommendations For Dr.Web version 4.32b, update to a version that fixes the "magic byte bug" to prevent remote attackers from bypassing virus scanning.

Correção

Identificadores relacionados

CVE-2005-3373

Produtos afetados

Dr.Web

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-3373 · Nota de Segurança
• http://securityelf.org/magicbyteadv.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3373 · Nota
• http://marc.info/?l=bugtraq&m=113026417802703&w=2 · Nota
• http://securityfocus.com/bid/15189 · Nota
• http://securityelf.org/magicbyte.html · Nota
• http://securityelf.org/updmagic.html · Nota