CVE-2004-1876

The CVE-2004-1876 issue affects ClamAV's clamd (VirusEvent directive) prior to version 0.70. The vulnerability arises from using the "%f" parameter to substitute the file name, allowing a local user to trigger shell metacharacters and execute arbitrary commands with privileges of the antivirus pr...

CVE-2004-1876

The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon clamd before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name...

GLSA-200405-03 : ClamAV VirusEvent parameter vulnerability

The remote host is affected by the vulnerability described in GLSA-200405-03 ClamAV VirusEvent parameter vulnerability The VirusEvent parameter in the clamav.conf configuration file allows to specify a system command to run whenever a virus is found. This system command can make use of the '%f'...

ClamAV VirusEvent parameter vulnerability

Background From http://www.clamav.net/ : "Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for...

clamd - NEVER use "%f" in your "VirusEvent"

date: 30 March 2004 product: clam antivirus author: l0om - l0omatexcluded.org - www.excluded.org clam antivirus is a antivirus program which works very well. it comes with a lot of features and its easy to handle. for normal you start it from the command line on demand but if you use the the dazu...