CVE-2008-5542: Input Validation
Sunbelt VIPRE 3.1.1832.2 and possibly 3.1.1633.1, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this bypass?
The issue affects Sunbelt VIPRE 3.1.1832.2 and possibly 3.1.1633.1 when HTML documents are used with Internet Explorer 6 or 7. The supplied information does not establish exposure for other browser versions or VIPRE releases.
What does an attacker need to do to evade detection?
An attacker can craft an HTML document with an MZ header at the beginning and give it no extension, a .txt extension, or a .jpg extension. The example described includes a CVE-2006-5745 exploit in the document.
How can I identify potentially affected files?
Review HTML-delivered content and files with no extension, .txt, or .jpg extensions for an MZ header at the start of the file. Such a header indicates executable-style content despite the apparent filename extension.