Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

This update to ClamAV version 0.88.7 fixes various bugs :

  - Clam AntiVirus (ClamAV) allows remote attackers to cause     a denial of service (crash) via a malformed     base64-encoded MIME attachment that triggers a NULL     pointer dereference. (CVE-2006-5874)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to cause a denial of service (stack overflow and     application crash) by wrapping many layers of     multipart/mixed content around a document, a different     vulnerability than CVE-2006-5874 / CVE-2006-6406.
    (CVE-2006-6481)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to bypass virus detection by inserting invalid     characters into base64 encoded content in a     multipart/mixed MIME file, as demonstrated with the     EICAR test file. (CVE-2006-6406)

This update to ClamAV version 0.88.7 fixes various bugs :

CVE-2006-5874: Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a NULL pointer dereference.

CVE-2006-6481: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

CVE-2006-6406: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

The latest version of ClamAV, 0.88.7, fixes some bugs, including vulnerabilities with handling base64-encoded MIME attachment files that can lead to either a) a crash (CVE-2006-5874), or b) a bypass of virus detection (CVE-2006-6406).

As well, a vulnerability was discovered that allows remote attackers to cause a stack overflow and application crash by wrapping many layers of multipart/mixed content around a document (CVE-2006-6481).

The latest ClamAV is being provided to address these issues.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-6406     Hendrik Weimer discovered that invalid characters in     base64 encoded data may lead to bypass of scanning     mechanisms.

  - CVE-2006-6481     Hendrik Weimer discovered that deeply nested     multipart/mime MIME data may lead to denial of service.

The remote host is running the ClamAV antivirus client version.
This version of ClamAV is vulnerable to a flaw where file scanning can be bypassed by passing malformed MIME-encoded requests.  An attacker exploiting this flaw would be able to send malicious files through the antivirus product without detection. 

The remote host is running the Kaspersky antivirus client.
This version of Kaspersky is vulnerable to a flaw where file scanning can be bypassed by passing malformed MIME-encoded requests.  An attacker exploiting this flaw would be able to send malicious files through the antivirus product without being detected.

ID	Name	Product	Family	Severity
29397	SuSE 10 Security Update : clamav (ZYPP Patch Number 2390)	Nessus	SuSE Local Security Checks	medium
27177	openSUSE 10 Security Update : clamav (clamav-2391)	Nessus	SuSE Local Security Checks	medium
24613	Mandrake Linux Security Advisory : clamav (MDKSA-2006:230)	Nessus	Mandriva Local Security Checks	medium
23912	Debian DSA-1238-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	medium
3842	ClamAV < 0.88.7 MIME-encoded Scan Bypass (deprecated)	Nessus Network Monitor	Web Clients	medium
3841	Kaspersky Antivirus Client MIME-encoded Scan Bypass	Nessus Network Monitor	FTP Clients	medium

Detections

Analytics

CVE-2006-6406

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium