CVE-2008-5543: Input Validation
Symantec AntiVirus (SAV) 10, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5543?
CVE-2008-5543 is considered a critical vulnerability as it allows remote attackers to bypass malware detection.
How do I fix CVE-2008-5543?
To mitigate CVE-2008-5543, users should upgrade their Symantec AntiVirus to a version that addresses this vulnerability.
Which versions of Symantec AntiVirus are affected by CVE-2008-5543?
CVE-2008-5543 specifically affects Symantec AntiVirus version 10.0.
Can Internet Explorer versions affect the exploitation of CVE-2008-5543?
Yes, the exploitation of CVE-2008-5543 involves using Internet Explorer versions 6 and 7.
What types of files can bypass detection due to CVE-2008-5543?
CVE-2008-5543 allows malicious HTML documents to bypass detection when the file has no extension, a .txt extension, or a .jpg extension.