Off-by-one error in the get_unicode_name function (libclamav/vba_extract.c) in Clam Anti-Virus (ClamAV) before 0.94.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted VBA project file, which triggers a heap-based buffer overflow.

Various bugs such as an off-by-one buffer overflow in get_unicode_name() , a bug in URL parsing of the 'phishing' checks, as well as minor other issues have been fixed in clamav. (CVE-2008-5050)

Various bugs such as a get_unicode_name() off-by-one buffer overflow, a bug in URL parsing of phishing checks as well as minor other issues have been fixed in clamav. (CVE-2008-5050)

Various bugs such as a get_unicode_name() off-by-one buffer overflow, a bug in URL parsing of phishing checks as well as minor other issues have been fixed in ClamAV. (CVE-2008-5050)

An off-by-one error was found in ClamAV versions prior to 0.94.1 that could allow remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted VBA project file (CVE-2008-5050).

Other bugs have also been corrected in 0.94.1 which is being provided with this update.

Moritz Jodeit discovered that ClamAV did not correctly handle certain strings when examining a VBA project. If a remote attacker tricked ClamAV into processing a malicious VBA file, ClamAV would crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

The remote host is affected by the vulnerability described in GLSA-200812-21 (ClamAV: Multiple vulnerabilities)

    Moritz Jodeit reported an off-by-one error within the     get_unicode_name() function in libclamav/vba_extract.c when processing     VBA project files (CVE-2008-5050). Ilja van Sprundel reported an     infinite recursion error within the cli_check_jpeg_exploit() function     in libclamav/special.c when processing JPEG files (CVE-2008-5314).
  Impact :

    A remote attacker could send a specially crafted VBA or JPEG file to     the clamd daemon, possibly resulting in the remote execution of     arbitrary code with the privileges of the user running the application     or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Moritz Jodeit discovered that ClamAV, an anti-virus solution, suffers from an off-by-one-error in its VBA project file processing, leading to a heap-based buffer overflow and potentially arbitrary code execution (CVE-2008-5050 ).

Ilja van Sprundel discovered that ClamAV contains a denial of service condition in its JPEG file processing because it does not limit the recursion depth when processing JPEG thumbnails (CVE-2008-5314 ).

Security fixes from upstream 0.94 and 0.94.1: CVE-2008-3912 (#461461):
Multiple out-of-memory NULL pointer dereferences CVE-2008-3913 (#461461): Fix memory leak in the error code path in freshclam CVE-2008-3914 (#461461): File descriptor leak on the error code path CVE-2008-5050 (#470783): get_unicode_name() off-by-one buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes from upstream 0.94 and 0.94.1: CVE-2008-1389 (#461461):
Invalid memory access in the CHM unpacker CVE-2008-3912 (#461461):
Multiple out-of-memory NULL pointer dereferences CVE-2008-3913 (#461461): Fix memory leak in the error code path in freshclam CVE-2008-3914 (#461461): Multiple file descriptor leaks on the error code path CVE-2008-5050 (#470783): get_unicode_name() off-by-one buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.1.  Such versions have an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files, specifically in the 'get_unicode_name()' function of 'libclamav/vba_extract.c', when a specific 'name' buffer is passed to it.  Using a specially crafted VBA project file embedded in an OLE2 Office document, a remote attacker can trigger this vulnerability and execute arbitrary code on the remote host with the privileges of the 'clamd' process. 

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.1. Such versions have an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files, specifically in the 'get_unicode_name()' function of 'libclamav/vba_extract.c', when a specific 'name' buffer is passed to it.

Using a specially crafted VBA project file embedded in an OLE2 Office document, a remote attacker can trigger this vulnerability and execute arbitrary code on the remote host with the privileges of the 'clamd' process.

Advisory from Moritz Jodeit, November 8th, 2008 :

ClamAV contains an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files. Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the `clamd' process by sending an email with a prepared attachment.

A VBA project file embedded inside an OLE2 office document send as an attachment can trigger the off-by-one.

Entry from Thu Oct 30 13:52:42 CET 2008 (acab) in ChangeLog :

libclamav/vba_extract.c: get_unicode_name off-by-one, bb#1239 reported by Moritz Jodeit >moritz*jodeit.org<

ID	Name	Product	Family	Severity
58227	SuSE9 Security Update : clamav (YOU Patch Number 12293)	Nessus	SuSE Local Security Checks	high
41484	SuSE 10 Security Update : clamav (ZYPP Patch Number 5769)	Nessus	SuSE Local Security Checks	high
41254	SuSE9 Security Update : ClamAV (YOU Patch Number 12292)	Nessus	SuSE Local Security Checks	high
39932	openSUSE Security Update : clamav (clamav-305)	Nessus	SuSE Local Security Checks	high
36640	Mandriva Linux Security Advisory : clamav (MDVSA-2008:229)	Nessus	Mandriva Local Security Checks	high
36499	Ubuntu 8.10 : clamav vulnerability (USN-672-1)	Nessus	Ubuntu Local Security Checks	high
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
35268	GLSA-200812-21 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
35033	Debian DSA-1680-1 : clamav - buffer overflow, stack consumption	Nessus	Debian Local Security Checks	high
34945	openSUSE 10 Security Update : clamav (clamav-5773)	Nessus	SuSE Local Security Checks	high
34944	SuSE 10 Security Update : clamav (ZYPP Patch Number 5768)	Nessus	SuSE Local Security Checks	high
34775	Fedora 8 : clamav-0.92.1-4.fc8 (2008-9651)	Nessus	Fedora Local Security Checks	critical
34774	Fedora 9 : clamav-0.93.3-2.fc9 (2008-9644)	Nessus	Fedora Local Security Checks	critical
4744	ClamAV < 0.94.1 get_unicode_name() Function Off-by-One Buffer Overflow (deprecated)	Nessus Network Monitor	Web Clients	high
34729	ClamAV < 0.94.1 get_unicode_name() Off-by-One Buffer Overflow	Nessus	Gain a shell remotely	high
34728	FreeBSD : clamav -- off-by-one heap overflow in VBA project parser (24b64fb0-af1d-11dd-8a16-001b1116b350)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2008-5050

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high

high

high

critical

critical

high

high

high