Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.

New clamav version 0.97.8 (bnc#816865) :

  - CVE-2013-2020: Fix heap corruption

  - CVE-2013-2021: Fix overflow due to PDF key length     computation.

The remote host is affected by the vulnerability described in GLSA-201405-08 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted file, leading to       arbitrary code execution or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.2. It is, therefore, affected by the following vulnerabilities :

  - Two vulnerabilities exist in the included ClamAV     software, the most serious of which could allow an     attacker to execute arbitrary code remotely.
    (CVE-2013-2020 / CVE-2013-2021)

  - Three vulnerabilities exist in the included PostgreSQL     software, the most serious of which could result in     data corruption or privilege escalation.
    (CVE-2013-1899 / CVE-2013-1900 / CVE-2013-1901)

  - Multiple cross-site scripting issues exist in the     included Wiki Server software (CVE-2013-1034)

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

Fix 963920 Update to 0.97.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update contains clamav 0.97.8 which fixes security issues (bnc#816865) :

  - Fix heap corruption. (CVE-2013-2020)

  - Fix overflow due to PDF key length computation.
    (CVE-2013-2021)

This release of clamav provides version 0.97.8 and fixes several potential security issues (bnc#816865) :

  - Fix heap corruption. (CVE-2013-2020)

  - Fix overflow due to PDF key length computation.
    (CVE-2013-2021)

Update to 0.97.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ClamAV would incorrectly parse a UPX-packed executable, leading to possible inappropriate heap reads. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2020)

It was discovered that ClamAV would incorrectly parse a PDF document, potentially writing beyond the size of a static array. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2021).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the ClamAV clamd antivirus daemon on the remote host is earlier than 0.97.8 and is, therefore, potentially affected by the following vulnerabilities :

  - An overflow condition exists in the 'getsisstring()'     function in 'libclamav/sis.c' when handling SIS content.
    This flaw reportedly only affects GNU/Linux.
    (Issue 6808)

  - A heap overflow exists in the 'libclamav/pdf.c' when     handling a specially crafted encrypted PDF file.  This     flaw reportedly affects ClamAV 0.97.1 - 0.97.7 only.
    (Issue 7053)

  - A heap overflow exists in 'libclamav/pe.c' that is     triggered when handling a specially crafted UPX-packed     executable.  (Issue 7055)

Versions of ClamAV earlier than 0.97.8 are potentially affected by the following vulnerabilities : 

 - An overflow condition in 'libclamav/pdf.c' may be triggered as user-supplied input is not properly validated when handling a specially crafted encrypted PDF file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2013-2021)

 - An overflow condition in 'libclamav/pe.c' may be triggered as user-supplied input is not properly validated when handling a specially crafted UPX-packed executable file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2013-2020)

ClamAV 0.97.8 addresses several reported potential security bugs.

ID	Name	Product	Family	Severity
75004	openSUSE Security Update : clamav (openSUSE-SU-2013:0881-1)	Nessus	SuSE Local Security Checks	medium
74051	GLSA-201405-08 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
69932	Mac OS X : OS X Server < 2.2.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	critical
67295	Fedora 17 : clamav-0.97.8-2.fc17 (2013-10980)	Nessus	Fedora Local Security Checks	medium
67294	Fedora 18 : clamav-0.97.8-2.fc18 (2013-10953)	Nessus	Fedora Local Security Checks	medium
67289	Fedora 19 : clamav-0.97.8-2.fc19 (2013-10853)	Nessus	Fedora Local Security Checks	medium
66956	SuSE 10 Security Update : clamav (ZYPP Patch Number 8606)	Nessus	SuSE Local Security Checks	medium
66953	SuSE 11.2 / 11.3 Security Update : clamav (SAT Patch Numbers 7821 / 7915)	Nessus	SuSE Local Security Checks	medium
66454	Fedora 18 : clamav-0.97.8-1.fc18 (2013-8047)	Nessus	Fedora Local Security Checks	medium
66314	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 / 13.04 : clamav vulnerabilities (USN-1816-1)	Nessus	Ubuntu Local Security Checks	medium
66308	ClamAV < 0.97.8 Multiple Vulnerabilities	Nessus	Misc.	medium
6782	ClamAV < 0.97.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
66286	Mandriva Linux Security Advisory : clamav (MDVSA-2013:159)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-2020

high

Tenable Plugins

medium

critical

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium