CVE-2008-5544: Input Validation
Hacksoft The Hacker 6.3.1.2.174 and possibly 6.3.0.9.081, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this bypass?
The issue affects Hacksoft The Hacker 6.3.1.2.174 and possibly 6.3.0.9.081 when HTML documents are handled using Internet Explorer 6 or Internet Explorer 7. The provided data does not establish exposure for other browser versions or product releases.
What does an attacker need to do to evade malware detection?
An attacker must provide an HTML document with an MZ/EXE header at its beginning and name the file with no extension, a .txt extension, or a .jpg extension. The described demonstration used a document containing a CVE-2006-5745 exploit.
How can I identify potentially affected files?
Inspect HTML documents that begin with an MZ header or EXE information, particularly files distributed without an extension or masquerading as .txt or .jpg files. The bypass is specifically described for these filename forms when Internet Explorer 6 or 7 is used.