SOL6804 - ClamAV Portable Executable heap overflow Vulnerability - CVE-2006-4182

The FirePass controller provides anti-virus scanning of files uploaded through Portal Access from the ClamAV open source software (<http://www.clamav.net>). Scanning is enabled by selecting the Enable Standalone Virus Scanner option button on theAntivirus tab of the Portal Access: Content Inspection page.

A vulnerability in ClamAV 0.88.4 and earlier versions could allow a remote attacker to crash the scanner process (daemon) or execute code remotely using a specially-crafted Portable Executable (PE) file. This file format is commonly used by Windows-based executable binaries (applications). The ClamAV daemon can be terminated by a file crafted to crash the module which unpacks PE files.

F5 will fix this issue by upgrading to version 0.88.5 of ClamAV.

Information about this issue is available at the following locations:

<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4182&gt;

http://freshmeat.net/projects/clamav/?branch_id=29355&release_id=238714

<http://sourceforge.net/project/shownotes.php?release_id=455799&gt;

F5 Product Development tracked this issue as CR71088, and it was fixed in FirePass 6.0.1. For information about upgrading, refer to the FirePass release notes.

Additionally, a hotfix has been issued for all currently-supported versions of FirePass software. Customers running FirePass 5.5.2 or 6.0.0 should download the latest cumulative hotfix. Customers running other FirePass versions affected by this issue should contact F5 Technical Support to request the hotfix. Include the CR number and the number of this Solution in your correspondence.

For instructions about how to obtain a hotfix, refer to SOL167: Downloading software from F5.

For information about installing a hotfix, refer to SOL3430: Installing hotfixes.