The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to bypass scanning via a RAR file with a header flag value of 10, which can be processed by WinRAR.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2650     It was discovered that the OLE2 parser can be tricked     into an infinite loop and memory exhaustion.

  - CVE-2007-3023     It was discovered that the NsPack decompression code     performed insufficient sanitising on an internal length     variable, resulting in a potential buffer overflow.

  - CVE-2007-3024     It was discovered that temporary files were created with     insecure permissions, resulting in information     disclosure.

  - CVE-2007-3122     It was discovered that the decompression code for RAR     archives allows bypassing a scan of a RAR archive due to     insufficient validity checks.

  - CVE-2007-3123     It was discovered that the decompression code for RAR     archives performs insufficient validation of header     values, resulting in a buffer overflow.

Clamav had been found vulnerable to multiple vulnerabilities :

- Improper checking for the end of an buffer causing an unspecified attack vector.

- Insecure temporary file handling, which could be exploited to read sensitive information.

- A flaw in the parser engine which could allow a remote attacker to bypass the scanning of RAR files.

- A flaw in libclamav/unrar.c which could cause a remote Denial of Service (DoS) by sending a specially crafted RAR file with a modified vm_codesize.

- A flaw in the OLE2 parser which could cause a remote Denial of Service (DoS).

The remote host is affected by the vulnerability described in GLSA-200706-05 (ClamAV: Multiple Denials of Service)

    Several vulnerabilities were discovered in ClamAV by various     researchers:
    Victor Stinner (INL) discovered that the OLE2     parser may enter in an infinite loop (CVE-2007-2650).
    A     boundary error was also reported by an anonymous researcher in the file     unsp.c, which might lead to a buffer overflow (CVE-2007-3023).
    The file unrar.c contains a heap-based buffer overflow via a     modified vm_codesize value from a RAR file (CVE-2007-3123).
    The RAR parsing engine can be bypassed via a RAR file with a header     flag value of 10 (CVE-2007-3122).
    The cli_gentempstream()     function from clamdscan creates temporary files with insecure     permissions (CVE-2007-3024).
  Impact :

    A remote attacker could send a specially crafted file to the scanner,     possibly triggering one of the vulnerabilities. The two buffer     overflows are reported to only cause Denial of Service. This would lead     to a Denial of Service by CPU consumption or a crash of the scanner.
    The insecure temporary file creation vulnerability could be used by a     local user to access sensitive data.
  Workaround :

    There is no known workaround at this time.

A vulnerability in the OLE2 parser in ClamAV was found that could allow a remote attacker to cause a denial of service via resource consumption with a carefully crafted OLE2 file.

Other vulnerabilities and bugs have also been corrected in 0.90.3 which is being provided with this update.

ID	Name	Product	Family	Severity
25586	Debian DSA-1320-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	critical
25560	FreeBSD : clamav -- multiple vulnerabilities (903654bd-1927-11dc-b8a0-02e0185f8d72)	Nessus	FreeBSD Local Security Checks	critical
25534	GLSA-200706-05 : ClamAV: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	critical
25432	Mandrake Linux Security Advisory : clamav (MDKSA-2007:115)	Nessus	Mandriva Local Security Checks	critical

Detections

Analytics

CVE-2007-3122

high

Tenable Plugins

critical

critical

critical

critical