Heap-based buffer overflow in the cli_scanpe function in libclamav/pe.c in ClamAV before 0.98.5 allows remote attackers to cause a denial of service (crash) via a crafted y0da Crypter PE file.

Updated clamav packages fix security vulnerabilities :

ClamAV 0.98.6 is a maintenance release to fix some bugs, some of them being security bugs :

Certain JavaScript files causes ClamAV to segfault when scanned with the -a (list archived files) (CVE-2013-6497).

A heap buffer overflow was reported in ClamAV when scanning a specially crafted y0da Crypter obfuscated PE file (CVE-2014-9050).

Fix a heap out of bounds condition with crafted Yoda's crypter files.
This issue was discovered by Felix Groebert of the Google Security Team.

Fix a heap out of bounds condition with crafted mew packer files. This issue was discovered by Felix Groebert of the Google Security Team.

Fix a heap out of bounds condition with crafted upx packer files. This issue was discovered by Kevin Szkudlapski of Quarkslab.

Fix a heap out of bounds condition with crafted upack packer files.
This issue was discovered by Sebastian Andrzej Siewior (CVE-2014-9328).

Compensate a crash due to incorrect compiler optimization when handling crafted petite packer files. This issue was discovered by Sebastian Andrzej Siewior.

Two bugs were discovered in clamav and are fixed by this release.

One issue is in clamscan, the command line anti-virus scanner included in the package, which could lead to crashes when scanning certain files. (CVE-2013-6497)

The second issue is in libclamav which caused a heap buffer overflow when scanning a specially crafted y0da Crypter obfuscated PE file.
(CVE-2014-9050) 

If you use clamav, we highly recommend that you upgrade to this version.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-05 (Clam AntiVirus: Denial of service)

    A heap-based buffer overflow exists in the cli_scanpe function in       libclamav/pe.c in ClamAV.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a specially crafted file.
  Workaround :

    There is no known workaround at this time.

ClamAV 0.98.5 =============

ClamAV 0.98.5 also includes these new features and bug fixes :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.
    Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures. Andreas Cadhalpun     submitted the patch implementing this support.

    - Enhancements to the clambc command line utility to       assist ClamAV bytecode signature authors by providing       introspection into compiled bytecode programs.

    - Resolution of many of the warning messages from ClamAV       compilation.

    - Improved detection of malicious PE files.

    - Security fix for ClamAV crash when using 'clamscan
      -a'. This issue was identified by Kurt Siefried of Red       Hat.

    - Security fix for ClamAV crash when scanning       maliciously crafted yoda's crypter files. This issue,       as well as several other bugs fixed in this release,       were identified by Damien Millescamp of Oppida.

    - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant       mode. Thanks to Reinhard Max for supplying the patch.

    - Bug fixes and other feature enhancements.

Please see the ChangeLog file or GIT log for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

clamav was updated to version 0.98.5 to fix three security issues and several non-security issues.

These security issues have been fixed :

  - Crash when scanning maliciously crafted yoda's crypter     files. (CVE-2013-6497)

  - Heap-based buffer overflow when scanning crypted PE     files. (CVE-2014-9050)

  - Crash when using 'clamscan -a'. These non-security     issues have been fixed :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.

  - Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures.

  - Enhancements to the clambc command line utility to     assist ClamAV bytecode signature authors by providing     introspection into compiled bytecode programs.

  - Resolution of many of the warning messages from ClamAV     compilation.

  - Improved detection of malicious PE files.

  - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant     mode. (bnc#904207)

  - Fix server socket setup code in clamd. (bnc#903489)

  - Change updateclamconf to prefer the state of the old     config file even for commented-out options. (bnc#903719)

  - Fix infinite loop in clamdscan when clamd is not     running.

  - Fix buffer underruns when handling multi-part MIME email     attachments.

  - Fix configuration of OpenSSL on various platforms.

  - Fix linking issues with libclamunrar.

clamav was updated to version 0.98.5 to fix two security issues.

These security issues were fixed :

  - Segmentation fault when processing certain files     (CVE-2013-6497).

  - Heap-based buffer overflow when scanning crypted PE     files (CVE-2014-9050).

The following non-security issues were fixed :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.

  - Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures.

  - Enhancements to the clambc command line utility to     assist ClamAV bytecode signature authors by providing     introspection into compiled bytecode programs.

  - Resolution of many of the warning messages from ClamAV     compilation.

  - Improved detection of malicious PE files.

  - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant     mode (bnc#904207).

  - Fix server socket setup code in clamd (bnc#903489).

  - Change updateclamconf to prefer the state of the old     config file even for commented-out options (bnc#903719).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2423-1 advisory.

    Kurt Seifried discovered that ClamAV incorrectly handled certain JavaScript files. An attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2013-6497)

    Damien Millescamp discovered that ClamAV incorrectly handled certain PE files. An attacker could possibly     use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2014-9050)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.5. It is, therefore, potentially affected by the following vulnerabilities :

  - An error exists related to using the 'clamscan -a'     command to scan certain JavaScript files that could     cause the application to crash. (CVE-2013-6497)

  - Errors exist related to scanning maliciously crafted     Yoda's Crypter files that could cause a heap-based     buffer overflow or an application crash.
    (CVE-2014-9050)

ID	Name	Product	Family	Severity
82419	Mandriva Linux Security Advisory : clamav (MDVSA-2015:166)	Nessus	Mandriva Local Security Checks	high
82240	Debian DLA-95-1 : clamav security update	Nessus	Debian Local Security Checks	medium
79844	GLSA-201412-05 : Clam AntiVirus: Denial of service	Nessus	Gentoo Local Security Checks	medium
79772	Fedora 21 : clamav-0.98.5-1.fc21 (2014-15434)	Nessus	Fedora Local Security Checks	medium
79760	SuSE 11.3 Security Update : clamav (SAT Patch Number 10016)	Nessus	SuSE Local Security Checks	medium
79754	openSUSE Security Update : clamav (openSUSE-SU-2014:1560-1)	Nessus	SuSE Local Security Checks	medium
79607	Fedora 19 : clamav-0.98.5-1.fc19 (2014-15463)	Nessus	Fedora Local Security Checks	medium
79598	Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-2423-1)	Nessus	Ubuntu Local Security Checks	high
79388	ClamAV < 0.98.5 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2014-9050

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

high

medium