CVE-2008-5523

CVE-2008-5523 describes multiple antivirus products (e.g., Avast!, NVD-listed vendors, RISING, Sophos, Symantec, Sunbelt VIPRE, PrevX/Prevx1, PC Tools) failing to detect malware when an HTML document begins with an MZ header (EXE info) and a manipulated filename (no extension, .txt, or .jpg). The...

CVE-2008-5532

Ikarus Virus Utilities T3.1.1.45.0 and possibly T3.1.1.34.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt...

CVE-2008-5538

Prevx Prevx1 2, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as demonstrated ...

CVE-2008-5523

avast! antivirus 4.8.1281.0, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5522

Summary of CVE-2008-5522 : Affected products include AVG Anti-Virus 8.0.0.161 and related antivirus tools (e.g., NVD entries for RISING, Sophos, Symantec, Webwasher, Prevx, PC Tools, VIPRE) that, when Internet Explorer 6 or 7 is used, may bypass malware detection in HTML documents by embedding an...

CVE-2008-5530

CVE-2008-5530 describes a bypass of malware detection in HTML documents triggered when Internet Explorer 6/7 is used. The root cause involves placing an MZ header (EXE info) at the start of the document and manipulating the filename extension (no extension, .txt, or .jpg) to exploit a CVE-2006-57...

CVE-2008-5546

VirusBlokAda VBA32 3.12.8.5, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, as...

CVE-2008-5526

DrWeb Anti-virus 4.44.0.09170, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header aka "EXE info" at the beginning, and modifying the filename to have 1 no extension, 2 a .txt extension, or 3 a .jpg extension, a...

CVE-2008-5532

CVE-2008-5532 documents a bypass of malware detection in HTML carried out by Ikarus Virus Utilities (T3.1.1.45.0 and possibly T3.1.1.34.0) when used with Internet Explorer 6 or 7. The vulnerability stems from an attacker placing an MZ header (the “EXE info”) at the beginning of a document and ren...

CVE-2008-5535

CVE-2008-5535 concerns Norman Antivirus 5.80.02. When used with Internet Explorer 6 or 7, remote attackers can bypass malware detection in HTML documents by inserting an MZ header at the start and renaming the file with no extension, ".txt", or ".jpg" endings, as demonstrated by a document contai...

CVE-2005-3401

Multiple interpretation error in TheHacker 5.8.4.128 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a...

CVE-2005-3401

CVE-2005-3401 describes a vulnerability in TheHacker 5.8.4.128 where a multiple interpretation error permits a remote bypass of virus scanning by crafted files (e.g., BAT, HTML, EML) that carry an explicit MZ (EXE) byte sequence. The content can be treated as a safe type while still being executa...

CVE-2005-3400

The CVE-2005-3400 entry describes a vulnerability in Fortinet 2.48.0.0 identified as a multiple interpretation error. The issue allows remote attackers to bypass virus scanning by submitting a file type such as BAT, HTML, or EML that contains an MZ (EXE) magic byte sequence, causing the file to b...

CVE-2005-3399

CVE-2005-3399 relates to an interpretation error in CAT-QuickHeal 8.0 where a file type misclassification occurs due to an “MZ” magic-byte sequence (typically EXE) present in BAT/HTML/EML content. This causes the file to be treated as a safe type that could still be executed as a dangerous file o...

CVE-2005-3400

Multiple interpretation error in Fortinet 2.48.0.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a...

CVE-2005-3401

Multiple interpretation error in TheHacker 5.8.4.128 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a...

CVE-2005-3370

Multiple interpretation error in ArcaVir 2005 package 2005-06-21 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be...

CVE-2005-3371

Multiple interpretation error in AVG 7 7.0.323 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a...

CVE-2005-3372

Multiple interpretation error in eTrust CA 7.0.1.4 with the 11.9.1 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could...

CVE-2005-3378

Multiple interpretation error in Norman 5.81 with the 5.83.02 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still b...