PT-2005-4181 · Sophos · Sophos

Andrey Bayora · Published 2005-10-29 · Updated 2016-10-18 · CVE-2005-3382

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sophos version 3.91 with engine 2.28.4

Description The issue allows remote attackers to bypass virus scanning by manipulating files with specific magic byte sequences, such as the "MZ" sequence normally associated with EXE files, but also present in files like BAT, HTML, and EML. This manipulation can cause the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of this exploit is a "triple headed" program containing EXE, EML, and HTML content.

Recommendations For Sophos version 3.91 with engine 2.28.4, consider updating the engine to a version that does not contain this issue, or apply any available patches to resolve the multiple interpretation error. As a temporary workaround, consider enhancing the virus scanning configuration to inspect files more thoroughly, regardless of their apparent file type.

Fix

Related Identifiers

CVE-2005-3382

Affected Products

Sophos

References · 6

• http://securityelf.org/magicbyteadv.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3382 · Security Note
• http://marc.info/?l=bugtraq&m=113026417802703&w=2 · Note
• http://securityfocus.com/bid/15189 · Note
• http://securityelf.org/magicbyte.html · Note
• http://securityelf.org/updmagic.html · Note