Heap-based buffer overflow in pe.c in libclamav in ClamAV 0.92.1 allows remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary.

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.93 release, including :

ClamAV 0.92 allowed local users to overwrite arbitrary files via a symlink attack on temporary files or on .ascii files in sigtool, when utf16-decode is enabled (CVE-2007-6595).

ClamAV 0.92 did not recognize Base64 uuencoded archives, which allowed remoted attackers to bypass the sanner via a base64-uuencoded file (CVE-2007-6596).

A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary (CVE-2008-0314).

An integer overflow in libclamav prior to 0.92.1 allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggered a heap-based buffer overflow (CVE-2008-0318).

An unspecified vulnerability in ClamAV prior to 0.92.1 triggered heap corruption (CVE-2008-0728).

A buffer overflow in ClamAV 0.92 and 0.92.1 allowed remote attackers to execute arbitrary code via a crafted Upack PE file (CVE-2008-1100).

ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive (CVE-2008-1387).

A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary (CVE-2008-1833).

ClamAV prior to 0.93 allowed remote attackers to bypass the scanning engine via a RAR file with an invalid version number (CVE-2008-1835).

A vulnerability in rfc2231 handling in ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (crash) via a crafted message that produced a string that was not null terminated, triggering a buffer over-read (CVE-2008-1836).

A vulnerability in libclamunrar in ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (crash) via a crafted RAR file (CVE-2008-1837).

Other bugs have also been corrected in 0.93 which is being provided with this update. Because this new version has increased the major of the libclamav library, updated dependent packages are also being provided.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.5.  Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.5. 

Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-006 applied. 

This update contains security fixes for a number of programs.

The remote host is affected by the vulnerability described in GLSA-200805-19 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported:
    Damian Put reported a heap-based buffer overflow when processing PeSpin     packed PE binaries (CVE-2008-0314).
    Alin Rad Pop of Secunia Research reported a buffer overflow in the     cli_scanpe() function when processing Upack PE binaries     (CVE-2008-1100).
    Hanno Boeck reported an infinite loop when processing ARJ archives     (CVE-2008-1387).
    Damian Put and Thomas Pollet reported a heap-based buffer overflow when     processing WWPack compressed PE binaries (CVE-2008-1833).
    A buffer over-read was discovered in the rfc2231() function when     producing a string that is not NULL terminated (CVE-2008-1836).
    An unspecified vulnerability leading to 'memory problems' when scanning     RAR files was reported (CVE-2008-1837).
    Thierry Zoller reported that scanning of RAR files could be     circumvented (CVE-2008-1835).
  Impact :

    A remote attacker could entice a user or automated system to scan a     specially crafted file, possibly leading to the execution of arbitrary     code with the privileges of the user running ClamAV (either a system     user or the 'clamav' user if clamd is compromised), or a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

Security update - backport security fixes from 0.93: CVE-2008-1100 (#442360): Upack Processing Buffer Overflow Vulnerability CVE-2008-1387 (#442525): Endless loop / hang with crafted arj CVE-2008-0314 (#442740): PeSpin Heap Overflow Vulnerability CVE-2008-1833 (#442741): PE WWPack Heap Overflow Vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This version upgrade of ClamAV to 0.93 fixes a long list of vulnerabilities. These vulnerabilities can lead to remote code execution, bypassing the scanning engine, remote denial-of-service, local file overwrite. (CVE-2008-1837 / CVE-2008-1836 / CVE-2008-1835 / CVE-2008-1833 / CVE-2008-1387 / CVE-2008-1100 / CVE-2008-0314 / CVE-2007-6595 / CVE-2007-6596)

This version upgrade of ClamAV to 0.93 fixes a long list of vulnerabilities. These vulnerabilities can lead to remote code execution, bypassing the scanning engine, remote denial-of-service, local file overwrite. (CVE-2008-1837, CVE-2008-1836, CVE-2008-1835, CVE-2008-1833, CVE-2008-1387, CVE-2008-1100, CVE-2008-0314, CVE-2007-6595, CVE-2007-6596)

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0314     Damian Put discovered that a buffer overflow in the     handler for PeSpin binaries may lead to the execution of     arbitrary code.

  - CVE-2008-1100     Alin Rad Pop discovered that a buffer overflow in the     handler for Upack PE binaries may lead to the execution     of arbitrary code.

  - CVE-2008-1833     Damian Put and Thomas Pollet discovered that a buffer     overflow in the handler for WWPack-compressed PE     binaries may lead to the execution of arbitrary code.

The remote host is running ClamAV client.

This version of ClamAV is vulnerable to several flaws due to the way that it parses user-supplied input.  It has been reported that there is a heap overflow within the 'libclamav/pe.c' file.   An attacker exploiting these flaws would either crash the service or execute arbitrary code on the remote machine. 

ID	Name	Product	Family	Severity
37368	Mandriva Linux Security Advisory : clamav (MDVSA-2008:088)	Nessus	Mandriva Local Security Checks	critical
4682	Mac OS X < 10.5.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
34211	Mac OS X 10.5.x < 10.5.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
34210	Mac OS X Multiple Vulnerabilities (Security Update 2008-006)	Nessus	MacOS X Local Security Checks	critical
32417	GLSA-200805-19 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
32109	Fedora 8 : clamav-0.92.1-2.fc8 (2008-3420)	Nessus	Fedora Local Security Checks	critical
32097	Fedora 7 : clamav-0.92.1-2.fc7 (2008-3358)	Nessus	Fedora Local Security Checks	critical
32048	SuSE 10 Security Update : clamav (ZYPP Patch Number 5200)	Nessus	SuSE Local Security Checks	critical
32047	openSUSE 10 Security Update : clamav (clamav-5199)	Nessus	SuSE Local Security Checks	critical
32004	Debian DSA-1549-1 : clamav - buffer overflows	Nessus	Debian Local Security Checks	critical
4465	ClamAV < 0.93.0 Multiple Overflows (deprecated)	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2008-1833

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high