Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers.

Ulf Harnhammar and an anonymous researcher from Germany discovered a vulnerability in the protocol code of freshclam, a command line utility responsible for downloading and installing virus signature updates for ClamAV, the antivirus scanner for Unix. This could lead to a denial of service or potentially the execution of arbitrary code.

The remote host is running a version of Mac OS X 10.4.x that is prior to 10.4.7.

Mac OS X 10.4.7 contains several security fixes for the following programs :

 - AFP server
 - ImageIO
 - launched
 - OpenLDAP

Secunia reports :

A vulnerability has been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the HTTP client in the Freshclam command line utility. This can be exploited to cause a stack-based buffer overflow when the HTTP headers received from a web server exceeds 8KB.

Successful exploitation requires that Freshclam is used to download virus signature updates from a malicious mirror web server e.g. via DNS poisoning.

Ulf Harnhammar discovered that the freshclam tool does not do a proper check for the size of header data received from a web server. This could potentially allow a specially prepared HTTP server to exploit freshclam clients connecting to a database mirror and causing a DoS.

The updated packages have been updated to Clamav 0.88.2 which corrects this problem.

The remote host is affected by the vulnerability described in GLSA-200605-03 (ClamAV: Buffer overflow in Freshclam)

    Ulf Harnhammar and an anonymous German researcher discovered that     Freshclam fails to check the size of the header data returned by a     webserver.
  Impact :

    By enticing a user to connect to a malicious webserver an attacker     could cause the execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is running ClamAV, an antivirus application.  There is a remote buffer overflow within this version of ClamAV.  Specifically, if an attacker were able to spoof or gain control of a ClamAV update server, the attacker could craft a malicious HTTP response that would trigger a buffer overflow.  Successful exploitation would result in the execution of arbitrary code. 

ID	Name	Product	Family	Severity
22592	Debian DSA-1050-1 : clamav - buffer overflow	Nessus	Debian Local Security Checks	medium
21763	Mac OS X 10.4.x < 10.4.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
21496	FreeBSD : clamav -- Freshclam HTTP Header Buffer Overflow Vulnerability (b088bf48-da3b-11da-93e0-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
21320	Mandrake Linux Security Advisory : clamav (MDKSA-2006:080)	Nessus	Mandriva Local Security Checks	medium
21318	GLSA-200605-03 : ClamAV: Buffer overflow in Freshclam	Nessus	Gentoo Local Security Checks	medium
3525	ClamAV < 0.88.2 HTTP Header Remote Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2006-1989

critical

Tenable Plugins

medium

high

medium

medium

medium

medium