Antivirus Detection Bypass in Avast! Antivirus 4.8 by MZ Header

CVE-2008-5523

What is CVE-2008-5523?

The vulnerability present in Avast! Antivirus 4.8.1281.0 arises from its inability to detect certain malware embedded in HTML documents when accessed via Internet Explorer 6 or 7. Attackers can exploit this by prefixing an MZ header, commonly associated with executable files, to manipulate the file's extension or remove it entirely. This tactic enables the malware to evade detection, allowing malicious activities to occur undetected. The exploit demonstrates that by presenting the malware with misleading file types, such as .txt or .jpg, attackers can facilitate the delivery of harmful payloads.

References