Multiple format string vulnerabilities in the logging code in Clam AntiVirus (ClamAV) before 0.88.1 might allow remote attackers to execute arbitrary code. NOTE: as of 20060410, it is unclear whether this is a vulnerability, as there is some evidence that the arguments are actually being sanitized properly.

Several remote vulnerabilities have been discovered in the ClamAV anti-virus toolkit, which may lead to denial of service and potentially to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-1614     Damian Put discovered an integer overflow in the PE     header parser. This is only exploitable if the     ArchiveMaxFileSize option is disabled.

  - CVE-2006-1615     Format string vulnerabilities in the logging code have     been discovered, which might lead to the execution of     arbitrary code.

  - CVE-2006-1630     David Luyer discovered, that ClamAV can be tricked into     an invalid memory access in the cli_bitset_set()     function, which may lead to a denial of service.

Secunia reports :

Some vulnerabilities have been reported in ClamAV, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

An unspecified integer overflow error exists in the PE header parser in 'libclamav/pe.c'. Successful exploitation requires that the ArchiveMaxFileSize option is disabled.

Some format string errors in the logging handling in 'shared/output.c' may be exploited to execute arbitrary code.

An out-of-bounds memory access error in the 'cli_bitset_test()' function in 'ibclamav/others.c' may be exploited to cause a crash.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003. This security update contains fixes for the following applications :
AppKit
ImageIO
BOM
CFNetwork
ClamAV (Mac OS X Server only)
CoreFoundation
CoreGraphics
Finder
FTPServer
Flash Player
KeyChain
LaunchServices
libcurl
Mail
MySQL Manager (Mac OS X Server only)
Preview
QuickDraw
QuickTime Streaming Server
Ruby
Safari

The remote Mac OS X host is running a version of Quicktime prior to 7.1.  The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially-crafted image and media files.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having it opened using QuickTime player.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003.

This security update contains fixes for the following applications :

AppKit ImageIO BOM CFNetwork ClamAV (Mac OS X Server only) CoreFoundation CoreGraphics Finder FTPServer Flash Player KeyCHain LaunchServices libcurl Mail MySQL Manager (Mac OS X Server only) Preview QuickDraw QuickTime Streaming Server Ruby Safari

Damian Put discovered an integer overflow in the PE header parser in ClamAV that could be exploited if the ArchiveMaxFileSize option was disabled (CVE-2006-1614).

Format strings in the logging code could possibly lead to the execution of arbitrary code (CVE-2006-1615).

David Luyer found that ClamAV could be tricked into an invalid memory access in the cli_bitset_set() function, which could lead to a Denial of Service (CVE-2006-1630).

This update provides ClamAV 0.88.1 which corrects this issue and also fixes some other bugs.

The remote host is affected by the vulnerability described in GLSA-200604-06 (ClamAV: Multiple vulnerabilities)

    ClamAV contains format string vulnerabilities in the logging code     (CVE-2006-1615). Furthermore Damian Put discovered an integer overflow     in ClamAV's PE header parser (CVE-2006-1614) and David Luyer discovered     that ClamAV can be tricked into performing an invalid memory access     (CVE-2006-1630).
  Impact :

    By sending a malicious attachment to a mail server running ClamAV,     a remote attacker could cause a Denial of Service or the execution of     arbitrary code. Note that the overflow in the PE header parser is only     exploitable when the ArchiveMaxFileSize option is disabled.
  Workaround :

    There is no known workaround at this time.

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server and entice a curl user into browsing to the malicious server.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog 

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server that would reply with a malicious NTLM authentication request.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

The remote host is using a version of wget that contains a flaw in the way that it handles NTLM authentication data.  Specifically, a rogue website that returns malformed data during an NTLM authentication session will be able to execute arbitrary code on the local client machine. 

The remote host is running ClamAV, an antivirus application. There are a number of flaws that affect this version of ClamAV, and the vendor recommends upgrading to version 0.88.1 or higher. 

The remote host is using a version of wget that contains a flaw in the way that it handles NTLM authentication data.  Specifically, a rogue website that returns malformed data during an NTLM authentication session will be able to execute arbitrary code on the local client machine.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog

ID	Name	Product	Family	Severity
22566	Debian DSA-1024-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	critical
21446	FreeBSD : clamav -- Multiple Vulnerabilities (6a5174bd-c580-11da-9110-00123ffe8333)	Nessus	FreeBSD Local Security Checks	critical
3617	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus Network Monitor	Operating System Detection	medium
3616	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
21341	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus	MacOS X Local Security Checks	critical
21202	Mandrake Linux Security Advisory : clamav (MDKSA-2006:067)	Nessus	Mandriva Local Security Checks	critical
21199	GLSA-200604-06 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
3318	Curl < 7.15.1 Multiple Remote Overflows	Nessus Network Monitor	Web Clients	critical
3308	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Nessus Network Monitor	Operating System Detection	high
3256	Curl NTLM Buffer Overflow	Nessus Network Monitor	Web Clients	medium
3255	GNU WGet < 1.10.2 Buffer Overflow	Nessus Network Monitor	Web Clients	medium
3505	ClamAV < 0.88.1 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium
801390	Curl NTLM Buffer Overflow	Log Correlation Engine	Web Clients	high
801386	Curl <= 7.15.0 Multiple Remote Overflows	Log Correlation Engine	Web Clients	high
801197	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800982	GNU WGet < 1.10.2 Buffer Overflow	Log Correlation Engine	Web Clients	high
800798	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2006-1615

critical

Tenable Plugins

critical

critical

medium

high

critical

critical

critical

critical

high

medium

medium

medium

high

high

high

high

high