dbcve.org
FortinetHardware / appliance

CVE-2005-3400

MEDIUM · 5.0 CVSS v2.0 Published 2005-11-01
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
59/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Multiple interpretation error in Fortinet 2.48.0.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Fortinet antivirus version 2.48.0.0 contains a multiple interpretation error where files containing 'MZ' magic bytes (normally associated with EXE executables) embedded within BAT, HTML, or EML container files bypass virus scanning. The scanner incorrectly identifies the file as safe based on the outer file type, while the embedded executable content remains functional and can execute on the end system, known as a 'triple-headed' attack.

MitigationUpgrade Fortinet FortiGate/AV to a patched version that properly inspects embedded content regardless of container type, and consider implementing additional content disarm and reconstruction (CDR) or sandboxing for suspicious file types.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
FortinetHardware / appliance
Affected:= 2.48.0.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None

AV:N/AC:L/Au:N/C:N/I:P/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Fortinet antivirus installation
    Check system for Fortinet FortiGate or Fortinet antivirus software. Common locations: /opt/fortinet/ or check running processes for forti* daemons. On FortiGate appliances, use 'get system status' CLI command.
    Affected if Fortinet FortiGate or Fortinet AV is not found on the system, then this CVE does not apply.
  2. Determine Fortinet AV version
    Run 'forticlient -v' or check the installed package version. On FortiGate, use 'get system status' or 'fwctrl -v' to retrieve the antivirus engine version.
    Affected if Version is exactly 2.48.0.0 - this is the only affected version per the CVE.
  3. Verify antivirus scanning is enabled
    Confirm that real-time or on-demand scanning is active for the affected file types (BAT, HTML, EML). Check scanning profiles or policies that include these container file types.
    Affected if Scanning is disabled for BAT, HTML, or EML files, making the triple-headed attack possible.
  4. Test for embedded EXE detection (optional validation)
    Create a test file containing 'MZ' magic bytes (EXE header) embedded within a BAT, HTML, or EML container. Submit to the antivirus for scanning and verify it detects the embedded executable content.
    Affected if The AV passes the file as safe or does not detect the embedded MZ/EXE content - indicating vulnerability to this bypass.

A system is affected only if Fortinet antivirus version 2.48.0.0 is installed AND antivirus scanning is enabled for BAT, HTML, or EML files, allowing embedded executable content to bypass detection.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade Fortinet FortiGate/AV to a patched version that properly inspects embedded content regardless of container type, and consider implementing additional content disarm and reconstruction (CDR) or sandboxing for suspicious file types.

Fix this in Fortinet Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA1.0 h
10.0 hours of engineering $1,750
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2005-3400 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2005-3400 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data