K6804 : ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182

Security Advisory Description

Note: Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F5 security vulnerability response policy.

F5 products and versions that have been evaluated for this Security Advisory

The FirePass controller provides anti-virus scanning of files uploaded through Portal Access from the ClamAV open source software (<http://www.clamav.net>). Scanning is enabled by selecting the Enable Standalone Virus Scanner option button on theAntivirus tab of the Portal Access: Content Inspection page.

A vulnerability in ClamAV 0.88.4 and earlier versions could allow a remote attacker to crash the scanner process (daemon) or execute code remotely using a specially-crafted Portable Executable (PE) file. This file format is commonly used by Windows-based executable binaries (applications). The ClamAV daemon can be terminated by a file crafted to crash the module which unpacks PE files.

F5 will fix this issue by upgrading to version 0.88.5 of ClamAV.

Information about this issue is available at the following locations:

<https://vulners.com/cve/CVE-2006-4182&gt;

http://freshmeat.net/projects/clamav/?branch_id=29355&release_id=238714

F5 Product Development tracked this issue as CR71088, and it was fixed in FirePass 6.0.1. For information about upgrading, refer to the FirePass release notes.

Additionally, a hotfix has been issued for all currently-supported versions of FirePass software. Customers running FirePass 5.5.2 or 6.0.0 should download the latest cumulative hotfix. Customers running other FirePass versions affected by this issue should contact F5 Technical Support to request the hotfix. Include the CR number and the number of this Solution in your correspondence.

For instructions about how to obtain a hotfix, refer to K167: Downloading software from F5.

For information about installing a hotfix, refer to K3430: Installing hotfixes.