Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.

Gentoo Linux Security Advisory reports :

Clam AntiVirus is vulnerable to a buffer overflow in 'libclamav/upx.c' when processing malformed UPX-packed executables. It can also be sent into an infinite loop in 'libclamav/fsg.c' when processing specially crafted FSG-packed executables.

By sending a specially crafted file an attacker could execute arbitrary code with the permissions of the user running Clam AntiVirus, or cause a Denial of Service.

A vulnerability was discovered in ClamAV versions prior to 0.87. A buffer overflow could occure when processing malformed UPX-packed executables. As well, it could be sent into an infinite loop when processing specially crafted FSG-packed executables.

ClamAV version 0.87 is provided with this update which isn't vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200509-13 (Clam AntiVirus: Multiple vulnerabilities)

    Clam AntiVirus is vulnerable to a buffer overflow in     'libclamav/upx.c' when processing malformed UPX-packed executables. It     can also be sent into an infinite loop in 'libclamav/fsg.c' when     processing specially crafted FSG-packed executables.
  Impact :

    By sending a specially crafted file an attacker could execute     arbitrary code with the permissions of the user running Clam AntiVirus,     or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Two vulnerabilities have been discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The following problems were identified :

  - CAN-2005-2919     A potentially infinite loop could lead to a denial of     service.

  - CAN-2005-2920

    A buffer overflow could lead to a denial of service.

The remote host is running ClamAV, an open-source antivirus solution for Unix-like systems.  This version of ClamAV is reported to be vulnerable to a flaw where the parsing of a malicious file will cause the clamav process to overflow system memory, possibly resulting in an attacker executing code.  An attacker exploiting this flaw would need to be able to send a specially formed email to the system running ClamAV.  In addition, this version of ClamAV is vulnerable to a remote Denial of Service (DoS) attack that would render the service unavailable to valid users.  

ID	Name	Product	Family	Severity
21403	FreeBSD : clamav -- arbitrary code execution and DoS vulnerabilities (271498a9-2cd4-11da-a263-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
19921	Mandrake Linux Security Advisory : clamav (MDKSA-2005:166)	Nessus	Mandriva Local Security Checks	high
19812	GLSA-200509-13 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
19793	Debian DSA-824-1 : clamav - infinite loop, buffer overflow	Nessus	Debian Local Security Checks	high
3229	ClamAV < 0.86.3 Content-parsing Multiple Overflows (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2005-2920

high

Tenable Plugins

high

high

high

high

medium