CVE-2008-5538: Input Validation
Prevx Prevx1 2, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5538?
CVE-2008-5538 is considered a medium severity vulnerability due to its ability to allow malware detection bypass.
How does CVE-2008-5538 allow malware detection bypass?
CVE-2008-5538 allows malware detection bypass by using an MZ header in an HTML document and modifying the filename extensions to evade detection.
Which software is affected by CVE-2008-5538?
CVE-2008-5538 specifically affects Prevx Prevx1 version 2 when used with Internet Explorer 6 or 7.
What types of extensions can be used to exploit CVE-2008-5538?
Exploitation of CVE-2008-5538 can occur using files with no extension, a .txt extension, or a .jpg extension.
What actions should users take regarding CVE-2008-5538?
Users should disable or update Prevx Prevx1 and consider using alternative security solutions while accessing untrusted web content.