Lucene search

K
certCERTVU:599220
HistoryJun 28, 2006 - 12:00 a.m.

ClamAV vulnerable to buffer overflow via malicious database mirror

2006-06-2800:00:00
www.kb.cert.org
10

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.068 Low

EPSS

Percentile

93.7%

Overview

The Open Source anti-virus program ClamAV’s update engine, freshclam, contains a buffer overflow vulnerability. If exploited, an attacker could create a denial-of-service condition, or possibly run arbitrary code with the privileges of the freshclam process.

Description

Freshclam is a command line utility that installs and updates virus signatures that are used by the ClamAV anti-virus software. It uses the HTTP protocol to perform file downloads from various web servers that host virus signature updates.

By directly changing one of the HTTP mirrors, or by using another means of redirecting the freshclam process to an attacker-controlled HTTP server, the attacker could cause a denial-of-service condition by sending an oversized HTTP header to the freshclam process.

Note that ClamAV and freshclam server and client programs are available for Microsoft Windows, Linux, Apple OS X, and BSD operating systems.


Impact

A remote attacker may create a denial-of-service condition. The vendor reports that remote execution of arbitrary code would not be easy due to diversity of client platforms and architectures.


Solution

Upgrade
See the systems affected section of this document for information about specific vendors. Users who compile ClamAV from source are encouraged to upgrade to ClamAV version 0.88.2.


Vendor Information

599220

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

SUSE Linux __ Affected

Updated: June 28, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

SUSE Linux has released RPM patches the will update ClamAV to its newest version.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23599220 Feedback>).

Clam AntiVirus __ Unknown

Updated: June 28, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The ClamAV project has released version 0.88.2 to address this vulnerability.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23599220 Feedback>).

Debian GNU/Linux __ Unknown

Updated: June 28, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Debian project has fixed this problem for the stable distribution (sarge), and for the unstable distribution (sid). The old stable distribution (woody) does not contain clamav packages.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23599220 Feedback>).

CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This document was written by Ryan Giobbi.

Other Information

CVE IDs: CVE-2006-1989
Severity Metric: 0.11 Date Public:

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.068 Low

EPSS

Percentile

93.7%

Related for VU:599220