Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third party information.

Upgrade to version clamav 0.96.5 to fix :

  - CVE-2010-4260: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Denial of service bugs     while parsing PDFs.

  - CVE-2010-4261: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Memory corruption due to     an off-by-one error within the icon_cb() function.

The remote host is affected by the vulnerability described in GLSA-201110-20 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Clam AntiVirus. Please       review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute arbitrary code with the       privileges of the Clam AntiVirus process or cause a Denial of Service by       causing an affected user or system to scan a crafted file.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-001 applied. 

This security update contains fixes for the following products :

  - Apache
  - bzip2
  - ClamAV
  - ImageIO
  - Kerberos
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - Ruby
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

- Sat Dec 4 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.96.5-1300

    - updated to 0.96.5

    - CVE-2010-4260 Multiple errors within the processing of       PDF files can be exploited to e.g. cause a crash.

  - CVE-2010-4261 An off-by-one error within the 'icon_cb()'     function can be exploited to cause a memory corruption.

  - Sun Oct 31 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.96.4-1300

    - updated to 0.96.4

    - execute 'make check' (#640347) but ignore errors for       now because four checks are failing on f13

  - Wed Sep 29 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de>

    - lowered stop priority of sysv initscripts (#629435)

    - Wed Sep 22 2010 Enrico Scholz <enrico.scholz at       informatik.tu-chemnitz.de> - 0.96.3-1300

    - updated to 0.96.3

    - fixes CVE-2010-0405 in shipped bzlib.c copy

    - Sun Aug 15 2010 Enrico Scholz <enrico.scholz at       informatik.tu-chemnitz.de> - 0.96.2-1300

    - updated to 0.96.2

    - rediffed patches

    - removed the -jit-disable patch which is replaced       upstream by a more detailed configuration option.

  - Wed Aug 11 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de>

    - use 'groupmems', not 'usermod' to add a user to a       group because 'usermod' does not work when user does       not exist in local /etc/passwd

  - Tue Jun 1 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.96.1-1400

    - updated to 0.96.1

    - applied upstream patch which allows to disable JIT       compiler (#573191)

    - disabled JIT compiler by default

    - removed explicit 'pkgconfig' requirements in -devel       (#533956)

    - added some BRs

    - rediffed patches

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update of clamav to version 0.96.5 to fix :

  - Denial of service bugs while parsing PDFs.
    (CVE-2010-4260)

  - Memory corruption due to an off-by-one error within the     icon_cb() function. (CVE-2010-4261)

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.96.5. Such versions are reportedly affected by multiple vulnerabilities :

  - Multiple errors exist in the PDF processing functions in     'libclamav/pdf.c', which could lead to application     crashes. (Bugs 2358, 2380, 2396)

  - An off-by-one error exists in the handling of icons such     that a crafted icon may be used to cause an integer     overflow. (Bug 2344)

Arkadiusz Miskiewicz and others discovered that the PDF processing code in libclamav improperly validated input. This could allow a remote attacker to craft a PDF document that could crash clamav or possibly execute arbitrary code. (CVE-2010-4260, CVE-2010-4479)

It was discovered that an off-by-one error in the icon_cb function in pe_icons.c in libclamav could allow an attacker to corrupt memory, causing clamav to crash or possibly execute arbitrary code.
(CVE-2010-4261)

In the default installation, attackers would be isolated by the clamav AppArmor profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update of clamav to version 0.96.5 to fix :

  - Denial of service bugs while parsing PDFs.
    (CVE-2010-4260)

  - Memory corruption due to an off-by-one error within the     icon_cb() function (CVE-2010-4261)

Multiple vulnerabilities were discovered and corrected in clamav :

Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document (CVE-2010-4260, (CVE-2010-4479).

Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. NOTE: some of these details are obtained from third-party information (CVE-2010-4261).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated clamav packages have been upgraded to the 0.96.5 version that is not vulnerable to these issues.

- Sat Dec 4 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.96.5-1400

    - updated to 0.96.5

    - CVE-2010-4260 Multiple errors within the processing of       PDF files can be exploited to e.g. cause a crash.

  - CVE-2010-4261 An off-by-one error within the 'icon_cb()'     function can be exploited to cause a memory corruption.

  - Sun Oct 31 2010 Enrico Scholz <enrico.scholz at     informatik.tu-chemnitz.de> - 0.96.4-1400

    - updated to 0.96.4

    - execute 'make check' (#640347) but ignore errors for       now because four checks are failing on f13

  - Tue Oct 5 2010 jkeating - 0.96.3-1400.1

    - Rebuilt for gcc bug 634757

    - Wed Sep 29 2010 Enrico Scholz <enrico.scholz at       informatik.tu-chemnitz.de>

    - lowered stop priority of sysv initscripts (#629435)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of ClamAV earlier than 0.96.5 are potentially affected by multiple vulnerabilities :

  - Multiple error exists in the PDF processing functions in 'libclamav/pdf.c' which may lead to application crashes. (Bugs 2358, 2380, 2396)

  - An off-by-one error exists in the handling of icons such that a crafted icon may be used to cause an integer overflow. (Bug 2344)

ID	Name	Product	Family	Severity
75449	openSUSE Security Update : clamav (openSUSE-SU-2010:1041-1)	Nessus	SuSE Local Security Checks	high
56595	GLSA-201110-20 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53701	openSUSE Security Update : clamav (openSUSE-SU-2010:1041-1)	Nessus	SuSE Local Security Checks	high
53653	openSUSE Security Update : clamav (openSUSE-SU-2010:1041-1)	Nessus	SuSE Local Security Checks	high
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
52753	Mac OS X Multiple Vulnerabilities (Security Update 2011-001)	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
51346	Fedora 13 : clamav-0.96.5-1300.fc13 (2010-18564)	Nessus	Fedora Local Security Checks	high
51135	SuSE 10 Security Update : clamav (ZYPP Patch Number 7274)	Nessus	SuSE Local Security Checks	high
51125	ClamAV < 0.96.5 Multiple Vulnerabilities	Nessus	Misc.	high
51117	Ubuntu 10.04 LTS / 10.10 : clamav vulnerabilities (USN-1031-1)	Nessus	Ubuntu Local Security Checks	high
51112	SuSE 11 / 11.1 Security Update : clamav (SAT Patch Numbers 3645 / 3646)	Nessus	SuSE Local Security Checks	high
51111	SuSE9 Security Update : clamav (YOU Patch Number 12666)	Nessus	SuSE Local Security Checks	high
51071	Mandriva Linux Security Advisory : clamav (MDVSA-2010:249)	Nessus	Mandriva Local Security Checks	high
51068	Fedora 14 : clamav-0.96.5-1400.fc14 (2010-18568)	Nessus	Fedora Local Security Checks	high
5722	ClamAV < 0.96.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high

Detections

Analytics

CVE-2010-4261

critical

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high