Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The version update to 0.90.2 fixes among other things two security problems. (CVE-2007-1745 / CVE-2007-1997)

The version update to 0.90.2 fixes among other things two security problems (CVE-2007-1745, CVE-2007-1997).

iDefense discovered a stack-based overflow in ClamAV when processing negative values in .cab files. As well, multiple file descriptor leaks were also reported and fixed in chmunpack.c, pdf.c, and dblock.c.

This update provides ClamAV 0.90.2 which corrects these problems and provides new functionality.

The remote host is affected by the vulnerability described in GLSA-200704-21 (ClamAV: Multiple vulnerabilities)

    iDefense Labs have reported a stack-based buffer overflow in the     cab_unstore() function when processing negative values in .cab files.
    Multiple file descriptor leaks have also been reported in chmunpack.c,     pdf.c and dblock.c when processing .chm files.
  Impact :

    A remote attacker could send a specially crafted CHM file to the     scanner, possibly resulting in the remote execution of arbitrary code     with the privileges of the user running ClamAV.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1745     It was discovered that a file descriptor leak in the CHM     handler may lead to denial of service.

  - CVE-2007-1997     It was discovered that a buffer overflow in the CAB     handler may lead to the execution of arbitrary code.

  - CVE-2007-2029     It was discovered that a file descriptor leak in the PDF     handler may lead to denial of service.

The remote host is running the ClamAV antivirus client.

This version of ClamAV is vulnerable to multiple attack vectors.  The more serious of the flaws is a buffer overflow.  An attacker exploiting this flaw would need to be able to manipulate ClamAV to scan a malicious file (via email, web, etc.).  Successful exploitation would result in the attacker executing arbitrary code on the remote ClamAV scanner.  

ID	Name	Product	Family	Severity
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29400	SuSE 10 Security Update : clamav (ZYPP Patch Number 3081)	Nessus	SuSE Local Security Checks	high
27180	openSUSE 10 Security Update : clamav (clamav-3080)	Nessus	SuSE Local Security Checks	high
25189	Mandrake Linux Security Advisory : clamav (MDKSA-2007:098)	Nessus	Mandriva Local Security Checks	high
25109	GLSA-200704-21 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25098	Debian DSA-1281-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
3966	ClamAV < 0.90.2 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2007-1997

critical

Tenable Plugins

critical

high

high

high

high

high

medium