Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

This update to ClamAV version 0.90 fixes various bugs :

  - A filedescriptor leak in the handling of CAB files can     lead to a denial of service attack against the clamd     scanner daemon caused by remote attackers.
    (CVE-2007-0897)

  - A directory traversal in handling of MIME E-Mail headers     could be used by remote attackers to overwrite local     files owned by the user under which clamd is running.
    (CVE-2007-0898)

This update to ClamAV version 0.90 fixes various bugs :

CVE-2007-0897: A filedescriptor leak in the handling of CAB files can lead to a denial of service attack against the clamd scanner daemon caused by remote attackers.

CVE-2007-0898: A directory traversal in handling of MIME E-Mail headers could be used by remote attackers to overwrite local files owned by the user under which clamd is running.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit, which may lead to denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0897     It was discovered that malformed CAB archives may     exhaust file descriptors, which allows denial of     service.

  - CVE-2007-0898     It was discovered that a directory traversal     vulnerability in the MIME header parser may lead to     denial of service.

The remote host is affected by the vulnerability described in GLSA-200703-03 (ClamAV: Denial of Service)

    An anonymous researcher discovered a file descriptor leak error in the     processing of CAB archives and a lack of validation of the 'id'     parameter string used to create local files when parsing MIME headers.
  Impact :

    A remote attacker can send several crafted CAB archives with a     zero-length record header that will fill the available file descriptors     until no other is available, which will prevent ClamAV from scanning     most archives. An attacker can also send an email with specially     crafted MIME headers to overwrite local files with the permissions of     the user running ClamAV, such as the virus database file, which could     prevent ClamAV from detecting any virus.
  Workaround :

    The first vulnerability can be prevented by refusing any file of type     CAB, but there is no known workaround for the second issue.

Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
(CVE-2007-0897)

Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.
(CVE-2007-0898)

The update to 0.90 addresses these issues.

The remote host is running the ClamAV antivirus client.

This version of ClamAV is vulnerable to a flaw where a CAB file with a reported length of zero can cause ClamAV to crash.  In addition, the ClamAV application is vulnerable to a directory traversal flaw.  An attacker, by specifying a file name which has '../' or '..\' strings, can overwrite critical system files.  In both instances, the attacker only needs to be able to send files that are processed by ClamAV.   

ID	Name	Product	Family	Severity
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29398	SuSE 10 Security Update : clamav (ZYPP Patch Number 2631)	Nessus	SuSE Local Security Checks	medium
27178	openSUSE 10 Security Update : clamav (clamav-2632)	Nessus	SuSE Local Security Checks	medium
24776	Debian DSA-1263-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	medium
24751	GLSA-200703-03 : ClamAV: Denial of Service	Nessus	Gentoo Local Security Checks	medium
24675	Mandrake Linux Security Advisory : clamav (MDKSA-2007:043)	Nessus	Mandriva Local Security Checks	medium
3917	ClamAV < 0.90.0 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2007-0897

high

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium