Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2005-3221: Fortinet Antivirus can be fooled by malformed RAR files

CVE-2005-3221 · published 21 years ago

Summary

Fortinet Antivirus may miss a virus hidden inside a specially crafted RAR archive whose internal headers are malformed. The archive still opens in common tools like WinRAR, allowing a malicious program to run unnoticed. Update the antivirus to the latest version or apply the vendor’s recommended configuration changes to ensure proper scanning.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
fortinet	fortinet_antivirus	All versions `cpe:2.3:h:fortinet:fortinet_antivirus::::::::`

Original advisory text

Multiple interpretation error in unspecified versions of Fortinet Antivirus allows remote attackers to bypass virus detection via a malicious executable in a specially crafted RAR file with malformed central and local headers, which can still be opened by products such as Winrar and PowerZip, even though they are rejected as corrupted by Winzip and BitZipper.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.1 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published14 Oct 2005

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2005-3221 · NVD

Track software like this

Free during beta