Multiple integer overflows in the (1) TNEF, (2) CHM, or (3) FSG file format processors in libclamav for Clam AntiVirus (ClamAV) 0.86.1 and earlier allow remote attackers to gain privileges via a crafted e-mail message.

Neel Mehta and Alex Wheeler discovered integer overflow vulnerabilities in Clam AntiVirus when handling the TNEF, CHM, and FSG file formats. By sending a specially crafted file, an attacker could execute arbitrary code with the permissions of the user running Clam AV.

This update provides clamav 0.86.2 which is not vulnerable to these issues.

Several bugs were discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The following problems were identified :

  - CAN-2005-2450     Neel Mehta and Alex Wheeler discovered that Clam     AntiVirus is vulnerable to integer overflows when     handling the TNEF, CHM and FSG file formats.

  - CVE-NOMATCH

    Mark Pizzolato fixed a possible infinite loop that could     cause a denial of service.

The remote host is affected by the vulnerability described in GLSA-200507-25 (Clam AntiVirus: Integer overflows)

    Neel Mehta and Alex Wheeler discovered that Clam AntiVirus is     vulnerable to integer overflows when handling the TNEF, CHM and FSG     file formats.
  Impact :

    By sending a specially crafted file an attacker could execute arbitrary     code with the permissions of the user running Clam AntiVirus.
  Workaround :

    There is no known workaround at this time.

The remote host is running ClamAV, an open-source antivirus solution for Unix-like systems.  This version of ClamAV is reported to be vulnerable to a flaw where the parsing of a malicious file will cause the clamav process to overflow system memory, possibly resulting in an attacker executing code.  An attacker exploiting this flaw would need to be able to send a specially formed email to the system running ClamAV. 

ID	Name	Product	Family	Severity
19886	Mandrake Linux Security Advisory : clamav (MDKSA-2005:125)	Nessus	Mandriva Local Security Checks	high
19432	Debian DSA-776-1 : clamav - integer overflows, infinite loop	Nessus	Debian Local Security Checks	high
19327	GLSA-200507-25 : Clam AntiVirus: Integer overflows	Nessus	Gentoo Local Security Checks	high
3108	ClamAV < 0.86.2 Content-parsing Multiple Overflows (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2005-2450

high

Tenable Plugins

high

high

high

high