This site is deprecated. Please
CLICK HERE for latest updates
Short Name |
HTTP:STC:DL:CLAMAV-MEW-PACKED
|
Severity |
Major
|
Recommended |
No
|
Recommended Action |
Drop
|
Category |
HTTP
|
Keywords |
ClamAV libclamav MEW PE File Handling Integer Overflow
|
Release Date |
2010/10/11
|
Update Number |
1789
|
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+
|
HTTP: ClamAV libclamav MEW PE File Handling Integer Overflow
A buffer overflow vulnerability exists in the ClamAV AntiVirus product. The vulnerability can be triggered when the application processes crafted PE files. An unauthenticated attacker can exploit this vulnerability by delivering a crafted file to the scanning service resulting in injection and execution of arbitrary code. In a simple attack case aimed at creating a denial of service condition, the affected ClamAV daemon will terminate. This might allow for further exploitation of the target system, exposing the system to other threats in absence of the AntiVirus daemon. In a sophisticated attack scenario where the malicious user is successful in injecting and executing supplied code, the behaviour of the system is dependent on the nature of the injected code. Any code injected into the vulnerable component would execute in the security context of the affected ClamAV daemon.
Extended Description
ClamAV is prone to an integer-overflow vulnerability because it fails to properly verify user-supplied data.
Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the 'libclamav' library. Failed exploits may crash the application.
ClamAV 0.91.2 is vulnerable to this issue; other versions may also be affected.
Affected Products
- Apple mac_os_x_server 10.5
- Apple mac_os_x_server 10.5.1
- Apple mac_os_x_server 10.5.2
- Clam_anti-virus clamav 0.91.2
- Debian linux 4.0
- Debian linux 4.0 Alpha
- Debian linux 4.0 Amd64
- Debian linux 4.0 Arm
- Debian linux 4.0 Hppa
- Debian linux 4.0 Ia-32
- Debian linux 4.0 Ia-64
- Debian linux 4.0 M68k
- Debian linux 4.0 Mips
- Debian linux 4.0 Mipsel
- Debian linux 4.0 Powerpc
- Debian linux 4.0 S/390
- Debian linux 4.0 Sparc
- Gentoo linux
- Kolab groupware_server 2.1.Beta3
- Kolab kolab_groupware_server 2.0.1
- Kolab kolab_groupware_server 2.0.2
- Kolab kolab_groupware_server 2.0.3
- Kolab kolab_groupware_server 2.0.4
- Kolab kolab_groupware_server 2.1.0
- Kolab kolab_groupware_server 2.1Beta2
- Kolab kolab_groupware_server 2.2 Beta1
- Kolab kolab_groupware_server 2.2 Beta3
- Mandriva corporate_server 3.0.0
- Mandriva corporate_server 3.0.0 X86 64
- Mandriva corporate_server 4.0
- Mandriva corporate_server 4.0.0 X86 64
- Mandriva linux_mandrake 2007.0
- Mandriva linux_mandrake 2007.0 X86 64
- Mandriva linux_mandrake 2007.1
- Mandriva linux_mandrake 2007.1 X86 64
- Mandriva linux_mandrake 2008.0
- Mandriva linux_mandrake 2008.0 X86 64
- Red_hat fedora 7
- Red_hat fedora 8
- Suse linux 10.0 Ppc
- Suse linux 10.0 X86
- Suse linux 10.0 X86-64
- Suse linux 10.1 Ppc
- Suse linux 10.1 X86
- Suse linux 10.1 X86-64
- Suse linux_desktop 10
- Suse novell_linux_desktop 9.0.0
- Suse novell_linux_pos 9
- Suse open-enterprise-server
- Suse opensuse 10.2
- Suse opensuse 10.3
- Suse suse_linux_enterprise_desktop 10
- Suse suse_linux_enterprise_desktop 10 SP1
- Suse suse_linux_enterprise_server 10
- Suse suse_linux_enterprise_server 10 SP1
- Suse suse_linux_enterprise_server 8
- Suse suse_linux_openexchange_server 4.0.0
- Suse unitedlinux 1.0.0
References