Vulnerability in Mcafee Internet Security Suite
CVE-2005-3377
Multiple interpretation error in (1) McAfee Internet Security Suite 7.1.5 version 9.1.08 with the 4.4.00 engine and (2) McAfee Corporate 8.0.0 patch 10 with the 4400 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.1 (Medium). Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.013 (69.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 69.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Mcafee Internet Security Suite — versions 7.1.5_version_9.1.08_engine_4.4.00, 8.0.0_patch_10_engine_4400
References
- www.securityfocus.com/bid/15189 (vdb-entry)
- www.securityelf.org/magicbyte.html
- www.securityelf.org/magicbyteadv.html (Vendor Advisory)
- marc.info/ (mailing-list)
- www.securityelf.org/updmagic.html