The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of service (segmentation fault) via a DOC file with an invalid property tree, which triggers an infinite recursion in the ole2_walk_property_tree function.

Several vulnerabilities have been discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3239     The OLE2 unpacker allows remote attackers to cause a     segmentation fault via a DOC file with an invalid     property tree, which triggers an infinite recursion.

  - CVE-2005-3303     A specially crafted executable compressed with FSG 1.33     could cause the extractor to write beyond buffer     boundaries, allowing an attacker to execute arbitrary     code.

  - CVE-2005-3500     A specially crafted CAB file could cause ClamAV to be     locked in an infinite loop and use all available     processor resources, resulting in a denial of service.

  - CVE-2005-3501     A specially crafted CAB file could cause ClamAV to be     locked in an infinite loop and use all available     processor resources, resulting in a denial of service.

A number of vulnerabilities were discovered in ClamAV versions prior to 0.87.1 :

The OLE2 unpacker in clamd allows remote attackers to cause a DoS (segfault) via a DOC file with an invalid property tree (CVE-2005-3239)

The FSG unpacker allows remote attackers to cause 'memory corruption' and execute arbitrary code via a crafted FSG 1.33 file (CVE-2005-3303)

The tnef_attachment() function allows remote attackers to cause a DoS (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block (CVE-2005-3500)

Remote attackers could cause a DoS (infinite loop) via a crafted CAB file (CVE-2005-3501)

An improper bounds check in petite.c could allow attackers to perform unknown attacks via unknown vectors (CVE-2005-3587)

This update provides ClamAV 0.87.1 which corrects all of these issues.

The remote host is affected by the vulnerability described in GLSA-200511-04 (ClamAV: Multiple vulnerabilities)

    ClamAV has multiple security flaws: a boundary check was performed     incorrectly in petite.c, a buffer size calculation in unfsg_133 was     incorrect in fsg.c, a possible infinite loop was fixed in tnef.c and a     possible infinite loop in cabd_find was fixed in cabd.c . In addition     to this, Marcin Owsiany reported that a corrupted DOC file causes a     segmentation fault in ClamAV.
  Impact :

    By sending a malicious attachment to a mail server that is hooked with     ClamAV, a remote attacker could cause a Denial of Service or the     execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is running ClamAV, an open-source antivirus solution for Unix-like systems.  This version of ClamAV is reported vulnerable to a flaw where the parsing of a malicious file will cause the clamav process to enter an infinite loop.  Successful exploitation causes the clamd service to exit.  

ID	Name	Product	Family	Severity
22753	Debian DSA-887-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
20439	Mandrake Linux Security Advisory : clamav (MDKSA-2005:205)	Nessus	Mandriva Local Security Checks	critical
20154	GLSA-200511-04 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
3254	ClamAV < 0.87.2 Content-parsing DoS (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2005-3239

medium

Tenable Plugins

high

critical

critical

medium