Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:STC:DL:CLAMAV-JPEG-DOS |
|---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
ClamAV AntiVirus cli_check_jpeg_exploit Function Denial of Service |
Release Date |
2010/10/19 |
Update Number |
1794 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: ClamAV AntiVirus cli_check_jpeg_exploit Function Denial of Service
This signature detects attempts to exploit a known buffer overflow vulnerability in the ClamAV AntiVirus product. It can be triggered when the application processes crafted JPEG files. An unauthenticated attacker can exploit this by delivering a crafted file to the scanning service resulting in an unchecked recursion which consumes the stack and causes a denial-of-service condition. In a successful attack, the affected ClamAV daemon terminates. This can allow for further exploitation of the target system, exposing the system to other threats in absence of the AntiVirus daemon.
Extended Description
ClamAV is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause denial-of-service conditions. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed. Versions prior to ClamAV 0.94.2 are vulnerable.
Affected Products
- Apple mac_os_x_server 10.4.11
- Apple mac_os_x_server 10.5.6
- Clam_anti-virus clamav 0.93
- Clam_anti-virus clamav 0.93.1
- Clam_anti-virus clamav 0.94
- Clam_anti-virus clamav 0.94.1
- Debian linux 4.0
- Debian linux 4.0 Alpha
- Debian linux 4.0 Amd64
- Debian linux 4.0 Arm
- Debian linux 4.0 Hppa
- Debian linux 4.0 Ia-32
- Debian linux 4.0 Ia-64
- Debian linux 4.0 M68k
- Debian linux 4.0 Mips
- Debian linux 4.0 Mipsel
- Debian linux 4.0 Powerpc
- Debian linux 4.0 S/390
- Debian linux 4.0 Sparc
- Gentoo linux
- Kolab kolab_groupware_server 2.0.1
- Kolab kolab_groupware_server 2.0.2
- Kolab kolab_groupware_server 2.0.3
- Kolab kolab_groupware_server 2.0.4
- Kolab kolab_groupware_server 2.1.0
- Kolab kolab_groupware_server 2.2.0
- Mandriva corporate_server 3.0.0
- Mandriva corporate_server 3.0.0 X86 64
- Mandriva corporate_server 4.0
- Mandriva corporate_server 4.0.0 X86 64
- Mandriva linux_mandrake 2008.0
- Mandriva linux_mandrake 2008.0 X86 64
- Mandriva linux_mandrake 2008.1
- Mandriva linux_mandrake 2008.1 X86 64
- Mandriva linux_mandrake 2009.0
- Mandriva linux_mandrake 2009.0 X86 64
- Suse linux 10.3
- Suse linux 11
- Suse suse_linux_enterprise_server 10
- Suse suse_linux_enterprise_server 9
- Ubuntu ubuntu_linux 8.10 Amd64
- Ubuntu ubuntu_linux 8.10 I386
- Ubuntu ubuntu_linux 8.10 Lpia
- Ubuntu ubuntu_linux 8.10 Powerpc
- Ubuntu ubuntu_linux 8.10 Sparc
References
- BugTraq: 32555
- CVE: CVE-2008-5314