Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected.

Two security problems have been found in the antivirus scan engine 'clamav', which could be used by remote attackers sending prepared E-Mails containing special crafted infected files to potentially execute code.

  - A problem in dealing with PE (Portable Executables aka     Windows .EXE) files could result in an integer overflow,     causing a heap overflow, which could be used by     attackers to potentially execute code. (CVE-2006-4182)

  - A problem in dealing with CHM (compressed helpfile)     exists that could cause an invalid memory read, causing     the clamav engine to crash. (CVE-2006-5295)

Two security problems have been found and fixed in the antivirus scan engine 'clamav', which could be used by remote attackers sending prepared E-Mails containing special crafted infected files to potentially execute code.

CVE-2006-4182: A problem in dealing with PE (Portable Executables aka Windows .EXE) files could result in an integer overflow, causing a heap overflow, which could be used by attackers to potentially execute code.

CVE-2006-5295: A problem in dealing with CHM (compressed helpfile) exists that could cause an invalid memory read, causing the clamav engine to crash.

An integer overflow in previous versions of ClamAV could allow a remote attacker to cause a Denial of Service (scanning service crash) and execute arbitrary code via a Portable Executable (PE) file (CVE-2006-4182).

Another vulnerability could allow a remote attacker to cause a DoS via a crafted compressed HTML (CHM) file that causes ClamAV to read an invalid memory location (CVE-2006-5295).

These issues are corrected in ClamAV 0.88.5 which is provided with this update.

The remote host is affected by the vulnerability described in GLSA-200610-10 (ClamAV: Multiple Vulnerabilities)

    Damian Put and an anonymous researcher reported a potential heap-based     buffer overflow vulnerability in rebuildpe.c responsible for the     rebuilding of an unpacked PE file, and a possible crash in chmunpack.c     in the CHM unpacker.
  Impact :

    By sending a malicious attachment to a mail server running ClamAV, or     providing a malicious file to ClamAV through any other method, a remote     attacker could cause a Denial of Service and potentially the execution     of arbitrary code with the permissions of the user running ClamAV.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in the ClamAV malware scan engine, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4182     Damian Put discovered a heap overflow error in the     script to rebuild PE files, which could lead to the     execution of arbitrary code.

  - CVE-2006-5295     Damian Put discovered that missing input sanitising in     the CHM handling code might lead to denial of service.

The remote host is running ClamAV, an antivirus application.  There is a remote content-parsing flaw in this version of ClamAV that could lead to a heap overflow.  An attacker sending a malformed PE file would be able to exploit this flaw.  Successful exploitation would result in the attacker executing arbitrary code. 

ID	Name	Product	Family	Severity
29395	SuSE 10 Security Update : clamav (ZYPP Patch Number 2179)	Nessus	SuSE Local Security Checks	high
27175	openSUSE 10 Security Update : clamav (clamav-2180)	Nessus	SuSE Local Security Checks	high
24569	Mandrake Linux Security Advisory : clamav (MDKSA-2006:184)	Nessus	Mandriva Local Security Checks	high
22913	GLSA-200610-10 : ClamAV: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
22905	Debian DSA-1196-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
3794	ClamAV < 0.88.5 PE Handler Content-Parsing Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2006-4182

critical

Tenable Plugins

high

high

high

high

high

medium