Skip to Content.
Sympa Menu

sm-security - [SM-Security] Clam AntiVirus: several vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] Clam AntiVirus: several vulnerabilities
  • Date: Wed, 21 Sep 2005 00:17:23 +0200

Synopsis
========
Clam AntiVirus is subject to several vulnerabilities when handling
compressed executables.

Background
==========
Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of
this software is the integration with mail servers (attachment
scanning). The package provides a flexible and scalable multi-threaded
daemon, a commandline scanner, and a tool for automatic updating via
Internet.

Description
===========
CAN-2005-2919 and CAN-2005-2920:
When processing malformed UPX-packed executables, clamav is vulnerable
to a buffer overflow error in "libclamav/upx.c". clamav can also be
sent into an infinite loop in "libclamav/fsg.c" when processing
specially-crafted FSG-packed executables.

Impact
======
By sending a specially-crafted file, an attacker could execute
arbitrary code with the permissions of the user running Clam
AntiVirus, or cause a Denial of Service.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
clamav in all grimoires is affected. This is now fixed in devel, test,
stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All clamav users should upgrade to the latest available version:
# scribe update
# cast -c clamav

References
==========
[ 1 ] Clam AntiVirus: Release Notes
http://sourceforge.net/project/shownotes.php?release_id=356974
[ 2 ] GLSA 200509-13
http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36



  • [SM-Security] Clam AntiVirus: several vulnerabilities, Thomas HOUSSIN, 09/20/2005

Archive powered by MHonArc 2.6.24.

Top of Page