ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file, which triggers a NULL dereference in the cli_scanrtf function in libclamav/rtf.c; or (2) a crafted HTML document with a data: URI, which triggers a NULL dereference in the cli_html_normalise function in libclamav/htmlnorm.c. NOTE: some of these details are obtained from third party information.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

- Sat Aug 25 2007 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.91.2-2

    - fixed an open(2) issue

  - Sat Aug 25 2007 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.91.2-1

    - updated to 0.91.2 (SECURITY) :

    - CVE-2007-4510 DOS in RTF parser

    - DOS in html normalizer

    - arbitrary command execution by special crafted       recipients in clamav-milter's black-hole mode

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200709-14 (ClamAV: Multiple vulnerabilities)

    Nikolaos Rangos discovered a vulnerability in ClamAV which exists     because the recipient address extracted from email messages is not     properly sanitized before being used in a call to 'popen()' when     executing sendmail (CVE-2007-4560). Also, NULL pointer dereference     errors exist within the 'cli_scanrtf()' function in libclamav/rtf.c and     Stefanos Stamatis discovered a NULL pointer dereference vulnerability     within the 'cli_html_normalise()' function in libclamav/htmlnorm.c     (CVE-2007-4510).
  Impact :

    The unsanitized recipient address can be exploited to execute arbitrary     code with the privileges of the clamav-milter process by sending an     email with a specially crafted recipient address to the affected     system. Also, the NULL pointer dereference errors can be exploited to     crash ClamAV. Successful exploitation of the latter vulnerability     requires that clamav-milter is started with the 'black hole' mode     activated, which is not enabled by default.
  Workaround :

    There is no known workaround at this time.

BugTraq reports :

ClamAV is prone to multiple denial-of-service vulnerabilities.

A successful attack may allow an attacker to crash the application and deny service to users.

A vulnerability in ClamAV was discovered that could allow remote attackers to cause a denial of service via a crafted RTF file or a crafted HTML document with a data: URI, both of which trigger a NULL dereference (CVE-2007-4510).

A vulnerability in clamav-milter, when run in black hole mode, could allow remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call (CVE-2007-4560).

Other bugs have also been corrected in 0.91.2 which is being provided with this update.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4510     It was discovered that the RTF and RFC2397 parsers can     be tricked into dereferencing a NULL pointer, resulting     in denial of service.

  - CVE-2007-4560     It was discovered that clamav-milter performs     insufficient input sanitising, resulting in the     execution of arbitrary shell commands.

The oldstable distribution (sarge) is only affected by a subset of the problems. An update will be provided later.

The remote host is running the ClamAV anti-virus client.

This version of ClamAV is vulnerable to multiple denial of service (DoS) attacks when handling malformed files.  An attacker exploiting this flaw would only need the ability to send an email to the vulnerable system.  Successful exploitation would result in the application crashing.  

ID	Name	Product	Family	Severity
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
27747	Fedora 7 : clamav-0.91.2-2.fc7 (2007-2050)	Nessus	Fedora Local Security Checks	high
26104	GLSA-200709-14 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
26092	FreeBSD : clamav -- multiple remote Denial of Service vulnerabilities (b6f6da57-680a-11dc-b350-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	medium
25969	Mandrake Linux Security Advisory : clamav (MDKSA-2007:172)	Nessus	Mandriva Local Security Checks	high
25966	Debian DSA-1366-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
4183	ClamAV < 0.91.2 Multiple Remote DoS (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2007-4510

medium

Tenable Plugins

critical

high

high

medium

high

high

high