Andrey Bayora

**Name of the Vulnerable Software and Affected Versions** CAT-QuickHeal version 8.0 **Description** The issue allows remote attackers to bypass virus scanning by utilizing a file with an "MZ" magic byte sequence, typically associated with EXE files, but in this case, the file can be of type BAT, HTML, or EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of exploitation is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For CAT-QuickHeal version 8.0, consider updating to a newer version that addresses this issue, as the current version allows malicious files to bypass virus scanning due to the misinterpretation of the "MZ" magic byte sequence. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fortinet version 2.48.0.0 **Description** The issue allows remote attackers to bypass virus scanning by manipulating files with an "MZ" magic byte sequence, normally associated with EXE files, but also present in files like BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of exploitation is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For Fortinet version 2.48.0.0, update to a version that fixes the "magic byte bug" to prevent remote attackers from bypassing virus scanning.

**Name of the Vulnerable Software and Affected Versions** TheHacker version 5.8.4.128 **Description** A multiple interpretation error allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, normally associated with EXE files, but also present in files such as BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of this issue is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For TheHacker version 5.8.4.128, consider restricting the execution of files with the "MZ" magic byte sequence that are not typically associated with EXE files, such as BAT, HTML, and EML, until a patch is available. As a temporary workaround, avoid using applications that could execute these files as dangerous types.

**Name of the Vulnerable Software and Affected Versions** Dr.Web version 4.32b **Description** The issue allows remote attackers to bypass virus scanning by manipulating files with specific magic byte sequences, such as "MZ", which is typically associated with EXE files. This can cause certain file types, like BAT, HTML, and EML, to be treated as safe when they could still be executed as dangerous file types by applications on the end system. An example of exploitation is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For Dr.Web version 4.32b, update to a version that fixes the "magic byte bug" to prevent remote attackers from bypassing virus scanning.

**Name of the Vulnerable Software and Affected Versions** F-Prot version 3.16c **Description** The issue allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, which is normally associated with EXE files, but can be used in other file types such as BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. **Recommendations** For F-Prot version 3.16c, update to a newer version that addresses the multiple interpretation error to prevent bypassing of virus scanning.

**Name of the Vulnerable Software and Affected Versions** Ikarus demo version **Description** The issue allows remote attackers to bypass virus scanning by exploiting a multiple interpretation error. This can be achieved by using a file with an "MZ" magic byte sequence, typically associated with EXE files, in files such as BAT, HTML, and EML. As a result, these files are treated as safe types but can still be executed as dangerous file types by applications on the end system. An example of this exploit is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For the Ikarus demo version, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kaspersky version 5.0.372 **Description** The issue allows remote attackers to bypass virus scanning by exploiting a multiple interpretation error. This can be achieved via a file, such as BAT, HTML, and EML, containing an "MZ" magic byte sequence, which is normally associated with EXE. As a result, the file is treated as a safe type but could still be executed as a dangerous file type by applications on the end system. An example of this exploit is a "triple headed" program that contains EXE, EML, and HTML content. **Recommendations** For Kaspersky version 5.0.372, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** McAfee Internet Security Suite version 9.1.08 McAfee Corporate version 8.0.0 patch 10 **Description** The issue allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, which is normally associated with executable files. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. For example, a "triple headed" program containing executable, email, and HTML content can exploit this issue. **Recommendations** For McAfee Internet Security Suite version 9.1.08, update the engine to a version that fixes the multiple interpretation error. For McAfee Corporate version 8.0.0 patch 10, apply a patch that addresses the issue with the 4400 engine.

**Name of the Vulnerable Software and Affected Versions** ArcaVir 2005 package 2005-06-21 **Description** The issue allows remote attackers to bypass virus scanning by using a file with an "MZ" magic byte sequence, which is normally associated with EXE files, but can be used in files such as BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. **Recommendations** For ArcaVir 2005 package 2005-06-21, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Trend Micro PC-Cillin version 12.0.1244 Trend Micro OfficeScan version 7.0 **Description** The issue allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, which is normally associated with executable files. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. This can be demonstrated by a "triple headed" program that contains executable, email, and HTML content. **Recommendations** For Trend Micro PC-Cillin version 12.0.1244, update the virus scanning engine to a version that correctly identifies and scans files with the "MZ" magic byte sequence. For Trend Micro OfficeScan version 7.0, update the virus scanning engine to a version that correctly identifies and scans files with the "MZ" magic byte sequence.

**Name of the Vulnerable Software and Affected Versions** Panda Titanium 2005 version 4.02.01 **Description** The issue allows remote attackers to bypass virus scanning by exploiting a multiple interpretation error. This can be achieved by using a file with an "MZ" magic byte sequence, typically associated with EXE files, in files such as BAT, HTML, and EML. As a result, the file is treated as a safe type but can still be executed as a dangerous file type by applications on the end system. An example of this exploit is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For Panda Titanium 2005 version 4.02.01, update to a version that addresses this issue to prevent remote attackers from bypassing virus scanning.

**Name of the Vulnerable Software and Affected Versions** Ukrainian National Antivirus (UNA) version 1.83.2.16 with kernel 265 **Description** The issue allows remote attackers to bypass virus scanning by using files with an "MZ" magic byte sequence, which is normally associated with EXE files, but can be used in other file types such as BAT, HTML, and EML. This causes the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of this is a "triple headed" program that contains EXE, EML, and HTML content. **Recommendations** For Ukrainian National Antivirus (UNA) version 1.83.2.16 with kernel 265, consider updating to a newer version that addresses the "magic byte bug" to prevent remote attackers from bypassing virus scanning. As a temporary workaround, consider enhancing the scanning functionality to inspect files more thoroughly, regardless of their apparent type, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sophos version 3.91 with engine 2.28.4 **Description** The issue allows remote attackers to bypass virus scanning by manipulating files with specific magic byte sequences, such as the "MZ" sequence normally associated with EXE files, but also present in files like BAT, HTML, and EML. This manipulation can cause the file to be treated as a safe type, even though it could still be executed as a dangerous file type by applications on the end system. An example of this exploit is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For Sophos version 3.91 with engine 2.28.4, consider updating the engine to a version that does not contain this issue, or apply any available patches to resolve the multiple interpretation error. As a temporary workaround, consider enhancing the virus scanning configuration to inspect files more thoroughly, regardless of their apparent file type.

**Name of the Vulnerable Software and Affected Versions** Norman version 5.81 with the 5.83.02 engine **Description** The issue allows remote attackers to bypass virus scanning by exploiting a multiple interpretation error. This can be achieved by using a file with an "MZ" magic byte sequence, typically associated with EXE files, in files such as BAT, HTML, and EML. As a result, the file is treated as a safe type but can still be executed as a dangerous file type by applications on the end system. An example of this exploit is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For Norman version 5.81 with the 5.83.02 engine, consider updating to a newer version that addresses this issue, as the current version allows files to be misinterpreted and potentially executed as dangerous file types. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVG 7 version 7.0.323 **Description** The issue allows remote attackers to bypass virus scanning by exploiting a multiple interpretation error. This can be achieved through files with an "MZ" magic byte sequence, typically associated with EXE files, but also present in files like BAT, HTML, and EML. Such files can be treated as safe types but still executed as dangerous file types by applications on the end system. An example of exploitation is a "triple headed" program containing EXE, EML, and HTML content. **Recommendations** For AVG 7 version 7.0.323, consider updating to a newer version that addresses this issue, as the current version allows for the bypassing of virus scanning through specific file types.

**Name of the Vulnerable Software and Affected Versions** eTrust CA version 7.0.1.4 **Description** The issue allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence, which is normally associated with EXE. This causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system. A "triple headed" program that contains EXE, EML, and HTML content can demonstrate this issue. **Recommendations** For eTrust CA version 7.0.1.4, at the moment, there is no information about a newer version that contains a fix for this issue.