Sophos Small Business Suite 1.00 on Windows does not properly handle files whose names contain reserved MS-DOS device names such as (1) LPT1, (2) COM1, (3) AUX, (4) CON, or (5) PRN, which can allow malicious code to bypass detection when it is installed, copied, or executed.
iDEFENSE Security Advisory 09.22.04 - Remote exploitation of a design vulnerability in version 1.00 of Sophos Plc.'s Small Business Suite allows malicious code to evade detection.