Unspecified vulnerability in ClamAV before 0.88.5 allows remote attackers to cause a denial of service (scanning service crash) via a crafted Compressed HTML Help (CHM) file that causes ClamAV to "read an invalid memory location."

Two security problems have been found in the antivirus scan engine 'clamav', which could be used by remote attackers sending prepared E-Mails containing special crafted infected files to potentially execute code.

  - A problem in dealing with PE (Portable Executables aka     Windows .EXE) files could result in an integer overflow,     causing a heap overflow, which could be used by     attackers to potentially execute code. (CVE-2006-4182)

  - A problem in dealing with CHM (compressed helpfile)     exists that could cause an invalid memory read, causing     the clamav engine to crash. (CVE-2006-5295)

Two security problems have been found and fixed in the antivirus scan engine 'clamav', which could be used by remote attackers sending prepared E-Mails containing special crafted infected files to potentially execute code.

CVE-2006-4182: A problem in dealing with PE (Portable Executables aka Windows .EXE) files could result in an integer overflow, causing a heap overflow, which could be used by attackers to potentially execute code.

CVE-2006-5295: A problem in dealing with CHM (compressed helpfile) exists that could cause an invalid memory read, causing the clamav engine to crash.

An integer overflow in previous versions of ClamAV could allow a remote attacker to cause a Denial of Service (scanning service crash) and execute arbitrary code via a Portable Executable (PE) file (CVE-2006-4182).

Another vulnerability could allow a remote attacker to cause a DoS via a crafted compressed HTML (CHM) file that causes ClamAV to read an invalid memory location (CVE-2006-5295).

These issues are corrected in ClamAV 0.88.5 which is provided with this update.

Several remote vulnerabilities have been discovered in the ClamAV malware scan engine, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4182     Damian Put discovered a heap overflow error in the     script to rebuild PE files, which could lead to the     execution of arbitrary code.

  - CVE-2006-5295     Damian Put discovered that missing input sanitising in     the CHM handling code might lead to denial of service.

The remote host is running ClamAV, an antivirus application.  There is a remote content-parsing flaw in this version of ClamAV that could lead to a heap overflow.  An attacker sending a malformed PE file would be able to exploit this flaw.  Successful exploitation would result in the attacker executing arbitrary code. 

ID	Name	Product	Family	Severity
29395	SuSE 10 Security Update : clamav (ZYPP Patch Number 2179)	Nessus	SuSE Local Security Checks	high
27175	openSUSE 10 Security Update : clamav (clamav-2180)	Nessus	SuSE Local Security Checks	high
24569	Mandrake Linux Security Advisory : clamav (MDKSA-2006:184)	Nessus	Mandriva Local Security Checks	high
22905	Debian DSA-1196-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
3794	ClamAV < 0.88.5 PE Handler Content-Parsing Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2006-5295

medium

Tenable Plugins

high

high

high

high

medium