PT-2005-4198 · Fortinet · Fortinet

Andrey Bayora · Published 2005-11-01 · Updated 2016-10-18 · CVE-2005-3400

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Fortinet version 2.48.0.0

Description The issue allows remote attackers to bypass virus scanning by manipulating files with an "MZ" magic byte sequence, normally associated with EXE files, but also present in files like BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of exploitation is a "triple headed" program containing EXE, EML, and HTML content.

Recommendations For Fortinet version 2.48.0.0, update to a version that fixes the "magic byte bug" to prevent remote attackers from bypassing virus scanning.

Fix

Related Identifiers

CVE-2005-3400

Affected Products

Fortinet

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-3400 · Security Note
• http://marc.info/?l=bugtraq&m=113036131526435&w=2 · Note
• http://marc.info/?l=bugtraq&m=113026417802703&w=2 · Note