clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host appears to be running a version of Clamav-milter, a filter for sendmail, configured with '--black-hole-mode' that fails to sanitize recipient addresses of shell metacharacters before using them in a call to 'popen()' to determine whether to discard incoming messages.  An unauthenticated, remote attacker can leverage this issue to execute arbitrary code, typically as root.

- Sat Aug 25 2007 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.91.2-2

    - fixed an open(2) issue

  - Sat Aug 25 2007 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.91.2-1

    - updated to 0.91.2 (SECURITY) :

    - CVE-2007-4510 DOS in RTF parser

    - DOS in html normalizer

    - arbitrary command execution by special crafted       recipients in clamav-milter's black-hole mode

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200709-14 (ClamAV: Multiple vulnerabilities)

    Nikolaos Rangos discovered a vulnerability in ClamAV which exists     because the recipient address extracted from email messages is not     properly sanitized before being used in a call to 'popen()' when     executing sendmail (CVE-2007-4560). Also, NULL pointer dereference     errors exist within the 'cli_scanrtf()' function in libclamav/rtf.c and     Stefanos Stamatis discovered a NULL pointer dereference vulnerability     within the 'cli_html_normalise()' function in libclamav/htmlnorm.c     (CVE-2007-4510).
  Impact :

    The unsanitized recipient address can be exploited to execute arbitrary     code with the privileges of the clamav-milter process by sending an     email with a specially crafted recipient address to the affected     system. Also, the NULL pointer dereference errors can be exploited to     crash ClamAV. Successful exploitation of the latter vulnerability     requires that clamav-milter is started with the 'black hole' mode     activated, which is not enabled by default.
  Workaround :

    There is no known workaround at this time.

A vulnerability in ClamAV was discovered that could allow remote attackers to cause a denial of service via a crafted RTF file or a crafted HTML document with a data: URI, both of which trigger a NULL dereference (CVE-2007-4510).

A vulnerability in clamav-milter, when run in black hole mode, could allow remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call (CVE-2007-4560).

Other bugs have also been corrected in 0.91.2 which is being provided with this update.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4510     It was discovered that the RTF and RFC2397 parsers can     be tricked into dereferencing a NULL pointer, resulting     in denial of service.

  - CVE-2007-4560     It was discovered that clamav-milter performs     insufficient input sanitising, resulting in the     execution of arbitrary shell commands.

The oldstable distribution (sarge) is only affected by a subset of the problems. An update will be provided later.

The remote host is running the ClamAV anti-virus client.

This version of ClamAV is vulnerable to multiple denial of service (DoS) attacks when handling malformed files.  An attacker exploiting this flaw would only need the ability to send an email to the vulnerable system.  Successful exploitation would result in the application crashing.  

ID	Name	Product	Family	Severity
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29830	ClamAV clamav-milter black-hole-mode Sendmail Recipient Field Arbitrary Command Execution	Nessus	SMTP problems	high
27747	Fedora 7 : clamav-0.91.2-2.fc7 (2007-2050)	Nessus	Fedora Local Security Checks	high
26104	GLSA-200709-14 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
25969	Mandrake Linux Security Advisory : clamav (MDKSA-2007:172)	Nessus	Mandriva Local Security Checks	high
25966	Debian DSA-1366-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
4183	ClamAV < 0.91.2 Multiple Remote DoS (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2007-4560

critical

Tenable Plugins

critical

high

high

high

high

high

high