ClamAV upack heap buffer overflow vulnerability

Overview

The ClamAV anti-virus scanner contains a vulnerability that may allow an attacker to execute code or cause ClamAV to crash.

Description

The Portable Executable (PE) file format is a file format for executable files that is used in Microsoft Windows. PE files can be packed with executable packers, such as upack. The ClamAV anti-virus scanner can unpack and scan PE files that are packed with upack.

From ClamAV bug ID 878:
_Secunia Research has discovered a vulnerability in ClamAV, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the “cli_scanpe()” function in libclamav/pe.c. This can be exploited to cause a heap-based buffer overflow via a specially crafted “Upack” executable._

Note that the ClamAV team has disabled the scanning of PE files that were packed with upack in older versions of ClamAV to prevent this vulnerability from being exploited.

---

Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause ClamAV to crash.

---

Solution

Upgrade
Users are encouraged to upgrade to ClamAV .93, which was released to address this issue. Note that because of a workaround applied by the ClamAV team, ClamAV versions prior to .93 may not be able to scan PE files that were packed with the upack packer.

---

Do not run clamscan as root

To limit the impact of vulnerabilities in ClamAV, users and administrators should run clamscan with a limited user account.

---

Vendor Information

858595

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Clam AntiVirus Affected

Notified: April 15, 2008 Updated: April 18, 2008

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <https://www.clamav.net/bugzilla/show_bug.cgi?id=878&gt;
• <http://secunia.com/secunia_research/2008-11/&gt;
• <http://en.wikipedia.org/wiki/Portable_Executable&gt;
• <http://www.microsoft.com/whdc/system/platform/firmware/PECOFF.mspx&gt;
• <http://linux.die.net/man/1/clamscan&gt;

Acknowledgements

Thanks to Secunia Research and the ClamAV team for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	CVE-2008-1100, CVE-2008-0314
Severity Metric:	3.94 Date Public: