PT-2005-4180 · Una · Ukrainian National Antivirus

Andrey Bayora · Publicado 2005-10-29 · Atualizado 2016-10-18 · CVE-2005-3381

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ukrainian National Antivirus (UNA) version 1.83.2.16 with kernel 265

Description The issue allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, which is normally associated with EXE files, but can be used in other file types such as BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of this is a "triple headed" program that contains EXE, EML, and HTML content.

Recommendations For Ukrainian National Antivirus (UNA) version 1.83.2.16 with kernel 265, consider updating to a newer version that addresses the "magic byte bug" to prevent remote attackers from bypassing virus scanning. As a temporary workaround, consider enhancing the scanning functionality to inspect files more thoroughly, regardless of their apparent type, to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3381

Produtos afetados

Ukrainian National Antivirus

Referências · 6

• http://securityelf.org/magicbyteadv.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3381 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=113026417802703&w=2 · Nota
• http://securityfocus.com/bid/15189 · Nota
• http://securityelf.org/magicbyte.html · Nota
• http://securityelf.org/updmagic.html · Nota