ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled.

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.93 release, including :

ClamAV 0.92 allowed local users to overwrite arbitrary files via a symlink attack on temporary files or on .ascii files in sigtool, when utf16-decode is enabled (CVE-2007-6595).

ClamAV 0.92 did not recognize Base64 uuencoded archives, which allowed remoted attackers to bypass the sanner via a base64-uuencoded file (CVE-2007-6596).

A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary (CVE-2008-0314).

An integer overflow in libclamav prior to 0.92.1 allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggered a heap-based buffer overflow (CVE-2008-0318).

An unspecified vulnerability in ClamAV prior to 0.92.1 triggered heap corruption (CVE-2008-0728).

A buffer overflow in ClamAV 0.92 and 0.92.1 allowed remote attackers to execute arbitrary code via a crafted Upack PE file (CVE-2008-1100).

ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive (CVE-2008-1387).

A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary (CVE-2008-1833).

ClamAV prior to 0.93 allowed remote attackers to bypass the scanning engine via a RAR file with an invalid version number (CVE-2008-1835).

A vulnerability in rfc2231 handling in ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (crash) via a crafted message that produced a string that was not null terminated, triggering a buffer over-read (CVE-2008-1836).

A vulnerability in libclamunrar in ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (crash) via a crafted RAR file (CVE-2008-1837).

Other bugs have also been corrected in 0.93 which is being provided with this update. Because this new version has increased the major of the libclamav library, updated dependent packages are also being provided.

The remote host is affected by the vulnerability described in GLSA-200808-07 (ClamAV: Multiple Denials of Service)

    Damian Put has discovered an out-of-bounds memory access while     processing Petite files (CVE-2008-2713, CVE-2008-3215). Also, please     note that the 0.93 ClamAV branch fixes the first of the two attack     vectors of CVE-2007-6595 concerning an insecure creation of temporary     files vulnerability. The sigtool attack vector seems still unfixed.
  Impact :

    A remote attacker could entice a user or automated system to scan a     specially crafted Petite file, possibly resulting in a Denial of     Service (daemon crash). Also, the insecure creation of temporary files     vulnerability can be triggered by a local user to perform a symlink     attack.
  Workaround :

    There is no known workaround at this time.

This version upgrade of ClamAV to 0.93 fixes a long list of vulnerabilities. These vulnerabilities can lead to remote code execution, bypassing the scanning engine, remote denial-of-service, local file overwrite. (CVE-2008-1837 / CVE-2008-1836 / CVE-2008-1835 / CVE-2008-1833 / CVE-2008-1387 / CVE-2008-1100 / CVE-2008-0314 / CVE-2007-6595 / CVE-2007-6596)

This version upgrade of ClamAV to 0.93 fixes a long list of vulnerabilities. These vulnerabilities can lead to remote code execution, bypassing the scanning engine, remote denial-of-service, local file overwrite. (CVE-2008-1837, CVE-2008-1836, CVE-2008-1835, CVE-2008-1833, CVE-2008-1387, CVE-2008-1100, CVE-2008-0314, CVE-2007-6595, CVE-2007-6596)

Several vulnerabilities have been discovered in the Clam anti-virus toolkit, which may lead to the execution of arbitrary code or local denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-6595     It was discovered that temporary files are created     insecurely, which may result in local denial of service     by overwriting files.

  - CVE-2008-0318     Silvio Cesare discovered an integer overflow in the     parser for PE headers.

The version of clamav in the old stable distribution (sarge) is no longer supported with security updates.

The remote host is running the ClamAV antivirus client.

This version of ClamAV is vulnerable to a remote integer overflow due to a content-parsing flaw when handling malformed PE files.  An attacker exploiting this flaw would only need the ability to send a malformed attachment to a system protected by ClamAV.  Successful exploitation would result in the attacker overwriting critical memory blocks and either crashing the service or executing arbitrary code. 

ID	Name	Product	Family	Severity
37368	Mandriva Linux Security Advisory : clamav (MDVSA-2008:088)	Nessus	Mandriva Local Security Checks	critical
33853	GLSA-200808-07 : ClamAV: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	medium
32048	SuSE 10 Security Update : clamav (ZYPP Patch Number 5200)	Nessus	SuSE Local Security Checks	critical
32047	openSUSE 10 Security Update : clamav (clamav-5199)	Nessus	SuSE Local Security Checks	critical
31102	Debian DSA-1497-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	critical
4321	ClamAV < 0.92.0 PE File Handling Integer Overflow (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2007-6595

medium

Tenable Plugins

critical

medium

critical

critical

critical

high