CVE-2005-3377

medium Trellix
CVSS v3 Base Score
5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS Score
0.4%
Exploitation probability in 30 days
Top 36% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Confidentiality
P
Integrity
P
Availability
P
Published: October 30, 2005 (7501 days ago)
Last Modified: April 16, 2026
Vendor: Trellix
Source: NVD

Description

Multiple interpretation error in (1) McAfee Internet Security Suite 7.1.5 version 9.1.08 with the 4.4.00 engine and (2) McAfee Corporate 8.0.0 patch 10 with the 4400 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."

CWE

NVD-CWE-Other

Affected Products

mcafee internet security suite

References

🔗 marc.info 🔗 www.securityelf.org 🔗 www.securityelf.org 🔗 www.securityelf.org 🔗 www.securityfocus.com