unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2650     It was discovered that the OLE2 parser can be tricked     into an infinite loop and memory exhaustion.

  - CVE-2007-3023     It was discovered that the NsPack decompression code     performed insufficient sanitising on an internal length     variable, resulting in a potential buffer overflow.

  - CVE-2007-3024     It was discovered that temporary files were created with     insecure permissions, resulting in information     disclosure.

  - CVE-2007-3122     It was discovered that the decompression code for RAR     archives allows bypassing a scan of a RAR archive due to     insufficient validity checks.

  - CVE-2007-3123     It was discovered that the decompression code for RAR     archives performs insufficient validation of header     values, resulting in a buffer overflow.

Clamav had been found vulnerable to multiple vulnerabilities :

- Improper checking for the end of an buffer causing an unspecified attack vector.

- Insecure temporary file handling, which could be exploited to read sensitive information.

- A flaw in the parser engine which could allow a remote attacker to bypass the scanning of RAR files.

- A flaw in libclamav/unrar.c which could cause a remote Denial of Service (DoS) by sending a specially crafted RAR file with a modified vm_codesize.

- A flaw in the OLE2 parser which could cause a remote Denial of Service (DoS).

The remote host is affected by the vulnerability described in GLSA-200706-05 (ClamAV: Multiple Denials of Service)

    Several vulnerabilities were discovered in ClamAV by various     researchers:
    Victor Stinner (INL) discovered that the OLE2     parser may enter in an infinite loop (CVE-2007-2650).
    A     boundary error was also reported by an anonymous researcher in the file     unsp.c, which might lead to a buffer overflow (CVE-2007-3023).
    The file unrar.c contains a heap-based buffer overflow via a     modified vm_codesize value from a RAR file (CVE-2007-3123).
    The RAR parsing engine can be bypassed via a RAR file with a header     flag value of 10 (CVE-2007-3122).
    The cli_gentempstream()     function from clamdscan creates temporary files with insecure     permissions (CVE-2007-3024).
  Impact :

    A remote attacker could send a specially crafted file to the scanner,     possibly triggering one of the vulnerabilities. The two buffer     overflows are reported to only cause Denial of Service. This would lead     to a Denial of Service by CPU consumption or a crash of the scanner.
    The insecure temporary file creation vulnerability could be used by a     local user to access sensitive data.
  Workaround :

    There is no known workaround at this time.

A vulnerability in the OLE2 parser in ClamAV was found that could allow a remote attacker to cause a denial of service via resource consumption with a carefully crafted OLE2 file.

Other vulnerabilities and bugs have also been corrected in 0.90.3 which is being provided with this update.

The remote host is running the ClamAV anti-virus client.

This version of ClamAV is vulnerable to a denial of service (DoS) attack when handling malformed RAR archive files.  An attacker exploiting this flaw would only need the ability to send an email to the vulnerable system.  Successful exploitation would result in the application crashing. 

ID	Name	Product	Family	Severity
25586	Debian DSA-1320-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	critical
25560	FreeBSD : clamav -- multiple vulnerabilities (903654bd-1927-11dc-b8a0-02e0185f8d72)	Nessus	FreeBSD Local Security Checks	critical
25534	GLSA-200706-05 : ClamAV: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	critical
25432	Mandrake Linux Security Advisory : clamav (MDKSA-2007:115)	Nessus	Mandriva Local Security Checks	critical
4075	ClamAV < 0.90.3 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2007-3123

medium

Tenable Plugins

critical

critical

critical

critical

medium