PT-2004-1660 · Sophos · Sophos Small Business Suite

Published 2004-09-28 · Updated 2017-07-11 · CVE-2004-0552

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sophos Small Business Suite version 1.00

Description The issue arises from improper handling of files with names containing reserved MS-DOS device names, such as LPT1, COM1, AUX, CON, or PRN. This can enable malicious code to evade detection during installation, copying, or execution.

Recommendations For Sophos Small Business Suite version 1.00, consider implementing additional validation for file names to prevent the use of reserved MS-DOS device names, or apply a configuration change to properly handle such files and prevent malicious code from bypassing detection.

Exploit

Fix

Related Identifiers

CVE-2004-0552

Affected Products

Sophos Small Business Suite

References · 5

• 🔥 http://seifried.org/security/advisories/kssa-005.html · Exploit
• 🔥 https://exploit-db.com/exploits/24623 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0552 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17468 · Note
• http://idefense.com/application/poi/display?id=143&type=vulnerabilities · Note