libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."

This version update of clamav to 0.94 fixes numerous problems, including the following security issues :

  - Fix possible invalid memory access. (CVE-2008-1389)

  - Fix out-of-memory null dereference. (CVE-2008-3912)

  - Fix error path memory leaks and file descriptor leaks.
    (CVE-2008-3913, CVE-2008-3914)

This version update to 0.94 fixes numerous problems including some security relevant ones (CVE-2008-3912, CVE-2008-1389, CVE-2008-3913, CVE-2008-3914).

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including :

A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service (application crash) via a malformed CHM file (CVE-2008-1389).

A vulnerability in libclamav would allow attackers to cause a denial of service via vectors related to an out-of-memory condition (CVE-2008-3912).

Multiple memory leaks were found in ClamAV that could possibly allow attackers to cause a denial of service via excessive memory consumption (CVE-2008-3913).

A number of unspecified vulnerabilities in ClamAV were reported that have an unknown impact and attack vectors related to file descriptor leaks (CVE-2008-3914).

Other bugs have also been corrected in 0.94 which is being provided with this update. Because this new version has increased the major of the libclamav library, updated dependent packages are also being provided.

Update :

The previous update had experimental support enabled, which caused ClamAV to report the version as 0.94-exp rather than 0.94, causing ClamAV to produce bogus warnings about the installation being outdated. This update corrects that problem.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.  Such versions are affected by one or more of the following issues : 

  - A segmentation fault can occur when processing corrupted LZH files. (Bug #1052)

  - Invalid memory access errors in 'libclamav/chmunpack.c' when processing malformed CHM files may lead to a crash. (Bug #1089)

  - An out-of-memory null dereference issue exists in 'libclamav/message.c' / 'libclamav/mbox.c'. (Bug #1141)

  - Possible error path memory leaks exist in 'freshclam/manager.c'. (Bug #1141)

  - There is an invalid close on error path in 'shared/tar.c'. (Bug #1141)

  - There are multiple file descriptor leaks involving the 'error path' in 'libclamav/others.c' and 'libclamav/sis.c'. (Bug #1141).

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94. Such versions are affected by one or more of the following issues :

  - A segmentation fault can occur when processing corrupted     LZH files. (Bug #1052)

  - Invalid memory access errors in 'libclamav/chmunpack.c'     when processing malformed CHM files may lead to a     crash. (Bug #1089)

  - An out-of-memory null dereference issue exists in     'libclamav/message.c' / 'libclamav/mbox.c'. (Bug #1141)

  - Possible error path memory leaks exist in     'freshclam/manager.c'. (Bug #1141)

  - There is an invalid close on error path in     'shared/tar.c'. (Bug #1141)

  - There are multiple file descriptor leaks involving the     'error path' in 'libclamav/others.c' and     'libclamav/sis.c'. (Bug #1141)

Security fixes from upstream 0.94 and 0.94.1: CVE-2008-3912 (#461461):
Multiple out-of-memory NULL pointer dereferences CVE-2008-3913 (#461461): Fix memory leak in the error code path in freshclam CVE-2008-3914 (#461461): File descriptor leak on the error code path CVE-2008-5050 (#470783): get_unicode_name() off-by-one buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes from upstream 0.94 and 0.94.1: CVE-2008-1389 (#461461):
Invalid memory access in the CHM unpacker CVE-2008-3912 (#461461):
Multiple out-of-memory NULL pointer dereferences CVE-2008-3913 (#461461): Fix memory leak in the error code path in freshclam CVE-2008-3914 (#461461): Multiple file descriptor leaks on the error code path CVE-2008-5050 (#470783): get_unicode_name() off-by-one buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

The remote host is affected by the vulnerability described in GLSA-200809-18 (ClamAV: Multiple Denials of Service)

    Hanno boeck reported an error in libclamav/chmunpack.c when processing     CHM files (CVE-2008-1389). Other unspecified vulnerabilities were also     reported, including a NULL pointer dereference in libclamav     (CVE-2008-3912), memory leaks in freshclam/manager.c (CVE-2008-3913),     and file descriptor leaks in libclamav/others.c and libclamav/sis.c     (CVE-2008-3914).
  Impact :

    A remote attacker could entice a user or automated system to scan a     specially crafted CHM, possibly resulting in a Denial of Service     (daemon crash). The other attack vectors mentioned above could also     result in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Hanno Boeck reports :

A fuzzing test showed weakness in the chm parser of clamav, which can possibly be exploited. The clamav team has disabled the chm module in older versions though freshclam updates and has released 0.94 with a fixed parser.

This version update to 0.94 fixes numerous problems including some security relevant ones. (CVE-2008-3912 / CVE-2008-1389 / CVE-2008-3913 / CVE-2008-3914)

The remote host is running ClamAV client.

This version of ClamAV is vulnerable to a flaw within the 'libclamav/chmunpack.c' file.  Specifically, when handling malformed '.chm' files, the application fails to adequately parse the file.  An attacker sending a malformed .chm file to a server running ClamAV would be able to crash the service.

ID	Name	Product	Family	Severity
41239	SuSE9 Security Update : clamav (YOU Patch Number 12236)	Nessus	SuSE Local Security Checks	critical
39931	openSUSE Security Update : clamav (clamav-181)	Nessus	SuSE Local Security Checks	critical
38032	Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)	Nessus	Mandriva Local Security Checks	critical
4787	ClamAV < 0.94 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high
35087	ClamAV < 0.94 Multiple Vulnerabilities	Nessus	Gain a shell remotely	high
34775	Fedora 8 : clamav-0.92.1-4.fc8 (2008-9651)	Nessus	Fedora Local Security Checks	critical
34774	Fedora 9 : clamav-0.93.3-2.fc9 (2008-9644)	Nessus	Fedora Local Security Checks	critical
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	critical
34299	GLSA-200809-18 : ClamAV: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	critical
34189	FreeBSD : clamav -- CHM Processing Denial of Service (da5c4072-8082-11dd-9c8c-001c2514716c)	Nessus	FreeBSD Local Security Checks	medium
34167	SuSE 10 Security Update : clamav (ZYPP Patch Number 5579)	Nessus	SuSE Local Security Checks	critical
34166	openSUSE 10 Security Update : clamav (clamav-5578)	Nessus	SuSE Local Security Checks	critical
4642	ClamAV < 0.93.1 memcpy() .chm File Handling DoS (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2008-1389

medium

Tenable Plugins

critical

critical

critical

high

high

critical

critical

critical

critical

medium

critical

critical

high