CVE-2008-5527: eset smart_security Improper Input Validation

Vulnerability summary

CVE-2008-5527 is a high (CVSS 9.3) Improper Input Validation vulnerability in eset smart_security. EPSS estimates a 2.24% chance of exploitation in the next 30 days, higher than 82.5% of scored vulnerabilities.

Timeline

1. 12-12-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

ESET Smart Security, when Internet Explorer 6 or 7 is used, allows remote attackers to bypass detection of malware in an HTML document by placing an MZ header (aka "EXE info") at the beginning, and modifying the filename to have (1) no extension, (2) a .txt extension, or (3) a .jpg extension, as demonstrated by a document containing a CVE-2006-5745 exploit.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.