Signature Detail
Short Name |
HTTP:STC:DL:CLAMAV-MEW-PACKED |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
ClamAV libclamav MEW PE File Handling Integer Overflow |
Release Date |
2010/10/11 |
Update Number |
1789 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: ClamAV libclamav MEW PE File Handling Integer Overflow
A buffer overflow vulnerability exists in the ClamAV AntiVirus product. The vulnerability can be triggered when the application processes crafted PE files. An unauthenticated attacker can exploit this vulnerability by delivering a crafted file to the scanning service resulting in injection and execution of arbitrary code. In a simple attack case aimed at creating a denial of service condition, the affected ClamAV daemon will terminate. This might allow for further exploitation of the target system, exposing the system to other threats in absence of the AntiVirus daemon. In a sophisticated attack scenario where the malicious user is successful in injecting and executing supplied code, the behaviour of the system is dependent on the nature of the injected code. Any code injected into the vulnerable component would execute in the security context of the affected ClamAV daemon.
Extended Description
ClamAV is prone to an integer-overflow vulnerability because it fails to properly verify user-supplied data. Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the 'libclamav' library. Failed exploits may crash the application. ClamAV 0.91.2 is vulnerable to this issue; other versions may also be affected.
Affected Products
- Apple Mac OS X Server 10.5
- Apple Mac OS X Server 10.5.1
- Apple Mac OS X Server 10.5.2
- Clam Anti-Virus ClamAV 0.91.2
- Debian Linux 4.0
- Debian Linux 4.0 Alpha
- Debian Linux 4.0 Amd64
- Debian Linux 4.0 Arm
- Debian Linux 4.0 Hppa
- Debian Linux 4.0 Ia-32
- Debian Linux 4.0 Ia-64
- Debian Linux 4.0 M68k
- Debian Linux 4.0 Mips
- Debian Linux 4.0 Mipsel
- Debian Linux 4.0 Powerpc
- Debian Linux 4.0 S/390
- Debian Linux 4.0 Sparc
- Gentoo Linux
- Kolab Groupware Server 2.1.Beta3
- Kolab Kolab Groupware Server 2.0.1
- Kolab Kolab Groupware Server 2.0.2
- Kolab Kolab Groupware Server 2.0.3
- Kolab Kolab Groupware Server 2.0.4
- Kolab Kolab Groupware Server 2.1.0
- Kolab Kolab Groupware Server 2.1Beta2
- Kolab Kolab Groupware Server 2.2 Beta1
- Kolab Kolab Groupware Server 2.2 Beta3
- Mandriva Corporate Server 3.0.0
- Mandriva Corporate Server 3.0.0 X86 64
- Mandriva Corporate Server 4.0
- Mandriva Corporate Server 4.0.0 X86 64
- Mandriva Linux Mandrake 2007.0
- Mandriva Linux Mandrake 2007.0 X86 64
- Mandriva Linux Mandrake 2007.1
- Mandriva Linux Mandrake 2007.1 X86 64
- Mandriva Linux Mandrake 2008.0
- Mandriva Linux Mandrake 2008.0 X86 64
- Red Hat Fedora 7
- Red Hat Fedora 8
- SuSE Linux 10.0 Ppc
- SuSE Linux 10.0 X86
- SuSE Linux 10.0 X86-64
- SuSE Linux 10.1 Ppc
- SuSE Linux 10.1 X86
- SuSE Linux 10.1 X86-64
- SuSE Linux Desktop 10
- SuSE Novell Linux Desktop 9.0.0
- SuSE Novell Linux POS 9
- SuSE Open-Enterprise-Server
- SuSE openSUSE 10.2
- SuSE openSUSE 10.3
- SuSE SUSE Linux Enterprise Desktop 10
- SuSE SUSE Linux Enterprise Desktop 10 SP1
- SuSE SUSE Linux Enterprise Server 10
- SuSE SUSE Linux Enterprise Server 10 SP1
- SuSE SUSE Linux Enterprise Server 8
- SuSE SuSE Linux Openexchange Server 4.0.0
- SuSE UnitedLinux 1.0.0
References
- BugTraq: 26927
- CVE: CVE-2007-6335