CVE-2005-3372 in Etrust Antivirus
Summary
by MITRE
Multiple interpretation error in eTrust CA 7.0.1.4 with the 11.9.1 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2017
The vulnerability identified as CVE-2005-3372 represents a critical file type interpretation error within the eTrust Central Administrator 7.0.1.4 security solution that utilizes the 11.9.1 detection engine. This flaw stems from the software's improper handling of file magic bytes, specifically the MZ signature that traditionally identifies executable files. The vulnerability manifests when the security application encounters files containing the MZ magic byte sequence in non-executable file types such as BAT, HTML, and EML formats. This misinterpretation causes the system to incorrectly classify these files as safe, bypassing critical virus scanning mechanisms that should identify potentially malicious content.
The technical exploitation of this vulnerability occurs through the manipulation of file headers and content structures that exploit the software's reliance on magic bytes for file type identification. When a file contains the MZ signature within its header but is actually a different file type, the eTrust scanner fails to properly analyze the file's true nature. This creates a dangerous scenario where malicious code embedded within legitimate file formats can evade detection, as demonstrated by the "triple headed" program concept that combines EXE, EML, and HTML content within a single file structure. The vulnerability specifically targets the software's file type recognition logic, which operates under the assumption that MZ signatures definitively indicate executable content.
The operational impact of this vulnerability extends beyond simple bypass of antivirus protection, creating a significant risk for end-user systems that execute files based on their content rather than their extension. When a file with embedded malicious code is incorrectly classified as safe due to the MZ magic byte, it can be executed by the target system's applications without proper security scrutiny. This creates a pathway for malware distribution and execution that circumvents the fundamental security controls intended to protect against malicious software. The vulnerability particularly affects systems where applications automatically execute files based on their content characteristics rather than traditional file extension-based identification methods.
The flaw aligns with CWE-20, which addresses "Improper Input Validation," and demonstrates how improper validation of file headers and magic bytes can create security bypass opportunities. From an ATT&CK framework perspective, this vulnerability maps to techniques involving evasion of security controls through manipulation of file characteristics and system interpretation mechanisms. Organizations implementing eTrust Central Administrator 7.0.1.4 with the affected 11.9.1 engine face significant risk of malware execution and data compromise. The vulnerability represents a fundamental design flaw in the file type detection mechanism that should have been addressed through proper input validation and file header analysis. Remediation efforts require immediate patching of the affected software version, implementation of additional file type validation measures, and potentially the deployment of supplementary security controls to compensate for the detection bypass.