CVE-2004-0552 in Sophos
Summary
by MITRE
Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1, (2) COM1, (3) AUX, (4) CON, or (5) PRN, which can allow malicious code to bypass detection when it is installed, copied, or executed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2025
This vulnerability exists in Sophos Small Business Suite version 1.00 running on Windows operating systems and represents a critical file name handling flaw that exploits the legacy MS-DOS device name restrictions. The vulnerability specifically affects how the software processes file names that contain reserved device names such as LPT1, COM1, AUX, CON, and PRN which are traditionally reserved in Windows for system device access. These device names have special significance in the Windows file system and are typically blocked or handled differently by the operating system to prevent conflicts with hardware devices. When the Sophos software encounters files with these reserved names during installation, copying, or execution processes, it fails to properly sanitize or validate these names, creating a potential security bypass mechanism.
The technical flaw stems from inadequate input validation within the Sophos Small Business Suite's file handling routines. When processing files with these specific device names, the software does not implement proper sanitization or rejection mechanisms that would normally be enforced by the Windows operating system itself. This creates an exploitation vector where malicious actors can craft files with these reserved names to evade security detection mechanisms. The vulnerability operates at the file system level where Windows normally would prevent execution or installation of files with these names, but the Sophos software's improper handling allows these files to proceed through its security checks. This behavior violates standard security practices and creates a pathway for malware to bypass endpoint protection measures that rely on file name validation.
The operational impact of this vulnerability is significant as it allows malicious code to circumvent security controls that would normally prevent execution of suspicious files. Attackers can leverage this flaw by creating malicious files with names containing the reserved device names, effectively bypassing the antivirus detection mechanisms of the Sophos suite. This creates a persistent threat vector where malware can be installed and executed without triggering security alerts, potentially leading to full system compromise. The vulnerability is particularly dangerous because it operates at the installation and execution phases, meaning that even if a file is detected during initial scanning, it can still be installed and executed successfully due to the flawed file name handling. This bypass capability undermines the fundamental security posture of the endpoint protection system.
Organizations running Sophos Small Business Suite 1.00 should implement immediate mitigations to address this vulnerability. The primary recommendation is to upgrade to a patched version of the software that properly handles reserved device names according to industry standards. System administrators should also implement additional file name validation at network boundaries and endpoint devices to prevent execution of files with these reserved names. The vulnerability aligns with CWE-20 Improper Input Validation and maps to ATT&CK technique T1059 Command and Scripting Interpreter where adversaries use system-level techniques to execute malicious code. Organizations should also consider implementing network segmentation and monitoring for suspicious file execution patterns that might indicate exploitation attempts. This vulnerability demonstrates the importance of proper input validation and adherence to established security protocols when handling file system operations in security software.