PT-2005-4173 · Frisk · F-Prot

Andrey Bayora · Published 2005-10-29 · Updated 2016-10-18 · CVE-2005-3374

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions F-Prot version 3.16c

Description The issue allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, which is normally associated with EXE files, but can be used in other file types such as BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system.

Recommendations For F-Prot version 3.16c, update to a newer version that addresses the multiple interpretation error to prevent bypassing of virus scanning.

Fix

Related Identifiers

CVE-2005-3374

Affected Products

F-Prot

References · 6

• http://securityelf.org/magicbyteadv.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3374 · Security Note
• http://marc.info/?l=bugtraq&m=113026417802703&w=2 · Note
• http://securityfocus.com/bid/15189 · Note
• http://securityelf.org/magicbyte.html · Note
• http://securityelf.org/updmagic.html · Note