clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.

Versions of ClamAV earlier than 0.98.5 are potentially affected by the following vulnerabilities : 

  - A flaw in the 'clamscan -a' command may cause a denial of service. The issue is triggered when a user opens a malformed JavaScript or Yoda Crypter file, resulting in a loss of availability of the program. (CVE-2013-6497) 

 - An overflow condition in the 'cli_scanpe()' function in 'libclamav/pe.c' may be triggered as user-supplied input is not properly validated when scanning a specially crafted Yoda Crypter file potentially allowing a remote attacker to cause a heap-based buffer overflow resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2013-9050)

Two bugs were discovered in clamav and are fixed by this release.

One issue is in clamscan, the command line anti-virus scanner included in the package, which could lead to crashes when scanning certain files. (CVE-2013-6497)

The second issue is in libclamav which caused a heap buffer overflow when scanning a specially crafted y0da Crypter obfuscated PE file.
(CVE-2014-9050) 

If you use clamav, we highly recommend that you upgrade to this version.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2488-1 fixed a vulnerability in ClamAV for Ubuntu 14.10, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. This update provides the corresponding update for Ubuntu 10.04 LTS.

Sebastian Andrzej Siewior discovered that ClamAV incorrectly handled certain upack packer files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ClamAV 0.98.5 =============

ClamAV 0.98.5 also includes these new features and bug fixes :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.
    Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures. Andreas Cadhalpun     submitted the patch implementing this support.

    - Enhancements to the clambc command line utility to       assist ClamAV bytecode signature authors by providing       introspection into compiled bytecode programs.

    - Resolution of many of the warning messages from ClamAV       compilation.

    - Improved detection of malicious PE files.

    - Security fix for ClamAV crash when using 'clamscan
      -a'. This issue was identified by Kurt Siefried of Red       Hat.

    - Security fix for ClamAV crash when scanning       maliciously crafted yoda's crypter files. This issue,       as well as several other bugs fixed in this release,       were identified by Damien Millescamp of Oppida.

    - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant       mode. Thanks to Reinhard Max for supplying the patch.

    - Bug fixes and other feature enhancements.

Please see the ChangeLog file or GIT log for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

clamav was updated to version 0.98.5 to fix three security issues and several non-security issues.

These security issues have been fixed :

  - Crash when scanning maliciously crafted yoda's crypter     files. (CVE-2013-6497)

  - Heap-based buffer overflow when scanning crypted PE     files. (CVE-2014-9050)

  - Crash when using 'clamscan -a'. These non-security     issues have been fixed :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.

  - Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures.

  - Enhancements to the clambc command line utility to     assist ClamAV bytecode signature authors by providing     introspection into compiled bytecode programs.

  - Resolution of many of the warning messages from ClamAV     compilation.

  - Improved detection of malicious PE files.

  - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant     mode. (bnc#904207)

  - Fix server socket setup code in clamd. (bnc#903489)

  - Change updateclamconf to prefer the state of the old     config file even for commented-out options. (bnc#903719)

  - Fix infinite loop in clamdscan when clamd is not     running.

  - Fix buffer underruns when handling multi-part MIME email     attachments.

  - Fix configuration of OpenSSL on various platforms.

  - Fix linking issues with libclamunrar.

clamav was updated to version 0.98.5 to fix two security issues.

These security issues were fixed :

  - Segmentation fault when processing certain files     (CVE-2013-6497).

  - Heap-based buffer overflow when scanning crypted PE     files (CVE-2014-9050).

The following non-security issues were fixed :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.

  - Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures.

  - Enhancements to the clambc command line utility to     assist ClamAV bytecode signature authors by providing     introspection into compiled bytecode programs.

  - Resolution of many of the warning messages from ClamAV     compilation.

  - Improved detection of malicious PE files.

  - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant     mode (bnc#904207).

  - Fix server socket setup code in clamd (bnc#903489).

  - Change updateclamconf to prefer the state of the old     config file even for commented-out options (bnc#903719).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2423-1 advisory.

    Kurt Seifried discovered that ClamAV incorrectly handled certain JavaScript files. An attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2013-6497)

    Damien Millescamp discovered that ClamAV incorrectly handled certain PE files. An attacker could possibly     use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2014-9050)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.5. It is, therefore, potentially affected by the following vulnerabilities :

  - An error exists related to using the 'clamscan -a'     command to scan certain JavaScript files that could     cause the application to crash. (CVE-2013-6497)

  - Errors exist related to scanning maliciously crafted     Yoda's Crypter files that could cause a heap-based     buffer overflow or an application crash.
    (CVE-2014-9050)

ClamAV 0.98.5 addresses several reported potential security bugs.

Certain JavaScript files causes ClamAV to segfault when scanned with the -a (list archived files) (CVE-2013-6497).

ID	Name	Product	Family	Severity
8825	ClamAV < 0.98.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
82240	Debian DLA-95-1 : clamav security update	Nessus	Debian Local Security Checks	medium
81341	Ubuntu 10.04 LTS : clamav vulnerability (USN-2488-2)	Nessus	Ubuntu Local Security Checks	high
79841	Amazon Linux AMI : clamav (ALAS-2014-457)	Nessus	Amazon Linux Local Security Checks	low
79772	Fedora 21 : clamav-0.98.5-1.fc21 (2014-15434)	Nessus	Fedora Local Security Checks	medium
79760	SuSE 11.3 Security Update : clamav (SAT Patch Number 10016)	Nessus	SuSE Local Security Checks	medium
79754	openSUSE Security Update : clamav (openSUSE-SU-2014:1560-1)	Nessus	SuSE Local Security Checks	medium
79607	Fedora 19 : clamav-0.98.5-1.fc19 (2014-15463)	Nessus	Fedora Local Security Checks	medium
79598	Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-2423-1)	Nessus	Ubuntu Local Security Checks	high
79399	Fedora 20 : clamav-0.98.5-1.fc20 (2014-15473)	Nessus	Fedora Local Security Checks	low
79388	ClamAV < 0.98.5 Multiple Vulnerabilities	Nessus	Misc.	medium
79367	Mandriva Linux Security Advisory : clamav (MDVSA-2014:217)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2013-6497

high

Tenable Plugins

medium

medium

high

low

medium

medium

medium

medium

high

low

medium

low