CVE-2008-5525: Input Validation
ClamAV 0.94.1 and possibly 0.93.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5525?
CVE-2008-5525 is classified as a medium severity vulnerability due to its ability to bypass malware detection.
How do I fix CVE-2008-5525?
To fix CVE-2008-5525, it is recommended to upgrade to ClamAV versions beyond 0.94.1.
What are the affected versions in CVE-2008-5525?
The affected versions for CVE-2008-5525 are ClamAV 0.93.1 and 0.94.1.
What type of attacks does CVE-2008-5525 facilitate?
CVE-2008-5525 facilitates attacks that can exploit malware detection bypass through specially crafted HTML documents.
Which browsers are involved in CVE-2008-5525?
CVE-2008-5525 involves Internet Explorer versions 6 and 7 when used with the vulnerable ClamAV versions.