CVE-2008-5543

Symantec AntiVirus SAV 10, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5547

CVE-2008-5547 concerns HAURI ViRobot 2008.12.4.1499 (and possibly 2008.9.12.1375). When used in Internet Explorer 6 or 7, it can bypass malware detection in an HTML document by placing an MZ header ("EXE info") at the beginning and renaming the file with no extension, .txt, or .jpg. This aligns w...

CVE-2008-5540

CVE-2008-5540 describes a bypass of malware detection in Secure Computing Secure Web Gateway (Webwasher) when using Internet Explorer 6/7. An attacker can place an MZ header at the start of an HTML document and modify the filename to have no extension, .txt, or .jpg, enabling the document to evad...

CVE-2008-5525

ClamAV 0.94.1 and possibly 0.93.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extensio...

CVE-2008-5535

CVE-2008-5535 concerns Norman Antivirus 5.80.02. When used with Internet Explorer 6 or 7, remote attackers can bypass malware detection in HTML documents by inserting an MZ header at the start and renaming the file with no extension, ".txt", or ".jpg" endings, as demonstrated by a document contai...

CVE-2008-5544

Hacksoft The Hacker 6.3.1.2.174 and possibly 6.3.0.9.081, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extensio...

CVE-2008-5544

The CVE-2008-5544 entry describes a vulnerability in Hacksoft The Hacker 6.3.1.2.174 (and possibly 6.3.0.9.081) where, when using Internet Explorer 6/7, an HTML document can bypass malware detection by inserting an MZ header at the beginning (an “EXE info”) and modifying the filename to have (1) ...

CVE-2008-5532

CVE-2008-5532 documents a bypass of malware detection in HTML carried out by Ikarus Virus Utilities (T3.1.1.45.0 and possibly T3.1.1.34.0) when used with Internet Explorer 6 or 7. The vulnerability stems from an attacker placing an MZ header (the “EXE info”) at the beginning of a document and ren...

CVE-2008-5534

ESET NOD32 Antivirus 3662 and possibly 3440, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jp...

CVE-2008-5548

VirusBuster 4.5.11.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5528

Aladdin eSafe 7.0.17.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5522

Summary of CVE-2008-5522 : Affected products include AVG Anti-Virus 8.0.0.161 and related antivirus tools (e.g., NVD entries for RISING, Sophos, Symantec, Webwasher, Prevx, PC Tools, VIPRE) that, when Internet Explorer 6 or 7 is used, may bypass malware detection in HTML documents by embedding an...

CVE-2008-5520

CVE-2008-5520 affects AhnLab V3 (2008.12.4.1 and possibly 2008.9.13.0) with Internet Explorer 6/7, enabling remote bypass of malware detection in HTML documents by prepending an MZ header (EXE info) and renaming the payload to have no extension, .txt, or .jpg extensions. The connected documents c...

CVE-2008-5531

Fortinet Antivirus 3.113.0.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5523

avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5538

Prevx Prevx1 2, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as demonstrated ...

CVE-2008-5520

AhnLab V3 2008.12.4.1 and possibly 2008.9.13.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a...

CVE-2008-5541: Improper Input Validation

Sophos Anti-Virus 4.33.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5525: Improper Input Validation

ClamAV 0.94.1 and possibly 0.93.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extensio...

CVE-2008-5546: Improper Input Validation

VirusBlokAda VBA32 3.12.8.5, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...