ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.

Versions of ClamAV earlier than 0.98.7 are potentially affected by the following vulnerabilities : 

 - An unspecified flaw exists in the 'pefromupx()' function in 'upx.c'. A remote attacker can exploit this flaw, via a specially crafted file, to crash the application. (CVE-2015-2170)
 - An unspecified flaw exists in the 'yc_poly_emulator()' function in 'yc.c'. A remote attacker can exploit this flaw, via a specially crafted y0da cryptor file, to cause an infinite loop and application hang. (CVE-2015-2221)
 - An unspecified flaw exists in the 'cli_scanpe()' function in 'pe.c'. A remote attacker can exploit this, via a specially crafted petite packer file, to crash the program. (CVE-2015-2222)
 - An integer overflow condition exists in the bundled Henry Spencer regex library in the 'regcomp()' function in 'regcomp.c' due to improper validation of user-supplied input. A remote attacker can exploit this to cause a buffer overflow, resulting in a denial of service or the execution of arbitrary code. (CVE-2015-2305)
 - An unspecified flaw exists when handling specially crafted '.xz' archive files. A remote attacker can exploit this to cause an infinite loop. (CVE-2015-2668)

The remote host is affected by the vulnerability described in GLSA-201512-08 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause ClamAV to scan a specially crafted file,       possibly resulting in a Denial of Service condition or other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file.
(CVE-2015-2221)

ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file. (CVE-2015-2668)

ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file. (CVE-2015-2222)

The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file. (CVE-2015-2170)

Upstream published version 0.98.7. This update updates sqeeze-lts to the latest upstream release in line with the approach used for other Debian releases.

The changes are not strictly required for operation, but users of the previous version in Squeeze may not be able to make use of all current virus signatures and might get warnings.

The bug fixes that are part of this release include security fixes related to packed or crypted files (CVE-2014-9328, CVE-2015-1461, CVE-2015-1462, CVE-2015-1463, CVE-2015-2170, CVE-2015-2221, CVE-2015-2222, and CVE-2015-2668) and several fixes to the embedded libmspack library, including a potential infinite loop in the Quantum decoder (CVE-2014-9556).

If you use clamav, we strongly recommend that you upgrade to this version.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ClamAV antivirus engine was updated to version 0.98.7 to fix several security and non-security issues.

The following vulnerabilities were fixed (bsc#929192) :

  - CVE-2015-2170: Fix crash in upx decoder with crafted     file. Discovered and patch supplied by Sebastian Andrzej     Siewior.

  - CVE-2015-2221: Fix infinite loop condition on crafted     y0da cryptor file. Identified and patch suggested by     Sebastian Andrzej Siewior.

  - CVE-2015-2222: Fix crash on crafted petite packed file.
    Reported and patch supplied by Sebastian Andrzej     Siewior.

  - CVE-2015-2668: Fix an infinite loop condition on a     crafted 'xz' archive file. This was reported by Dimitri     Kirchner and Goulven Guiheux.

  - CVE-2015-2305: Apply upstream patch for possible heap     overflow in Henry Spencer's regex library.

The following bugfixes were applyed (bsc#929192) :

  - Fix false negatives on files within iso9660 containers.
    This issue was reported by Minzhuan Gong.

  - Fix a couple crashes on crafted upack packed file.
    Identified and patches supplied by Sebastian Andrzej     Siewior.

  - Fix a crash during algorithmic detection on crafted PE     file. Identified and patch supplied by Sebastian Andrzej     Siewior.

  - Fix compilation error after ./configure
    --disable-pthreads. Reported and fix suggested by John     E. Krokes.

  - Fix segfault scanning certain HTML files. Reported with     sample by Kai Risku.

  - Improve detections within xar/pkg files.

  - Improvements to PDF processing: decryption, escape     sequence handling, and file property collection.

  - Scanning/analysis of additional Microsoft Office 2003     XML format.

ClamAV project reports :

ClamAV 0.98.7 is here! This release contains new scanning features and bug fixes.

Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.

Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2222.

Fix an infinite loop condition on a crafted 'xz' archive file. This was reported by Dimitri Kirchner and Goulven Guiheux. CVE-2015-2668.

Apply upstream patch for possible heap overflow in Henry Spencer's regex library. CVE-2015-2305.

Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170.

The ClamAV antivirus engine was updated to version 0.98.7 to fix several security issues :

  - Fix crash in upx decoder with crafted file. Discovered     and patch supplied by Sebastian Andrzej Siewior.
    (CVE-2015-2170)

  - Fix infinite loop condition on crafted y0da cryptor     file. Identified and patch suggested by Sebastian     Andrzej Siewior. (CVE-2015-2221)

  - Fix crash on crafted petite packed file. Reported and     patch supplied by Sebastian Andrzej Siewior.
    (CVE-2015-2222)

  - Fix an infinite loop condition on a crafted 'xz' archive     file. This was reported by Dimitri Kirchner and Goulven     Guiheux. (CVE-2015-2668)

  - Apply upstream patch for possible heap overflow in Henry     Spencer's regex library. (CVE-2015-2305)

ClamAV 0.98.7 =============

This release contains new scanning features and bug fixes.

  - Improvements to PDF processing: decryption, escape     sequence handling, and file property collection.

    - Scanning/analysis of additional Microsoft Office 2003       XML format.

    - Fix infinite loop condition on crafted y0da cryptor       file. Identified and patch suggested by Sebastian       Andrzej Siewior. CVE-2015-2221.

    - Fix crash on crafted petite packed file. Reported and       patch supplied by Sebastian Andrzej Siewior.
      CVE-2015-2222.

    - Fix false negatives on files within iso9660       containers. This issue was reported by Minzhuan Gong.

    - Fix a couple crashes on crafted upack packed file.
      Identified and patches supplied by Sebastian Andrzej       Siewior.

    - Fix a crash during algorithmic detection on crafted PE       file. Identified and patch supplied by Sebastian       Andrzej Siewior.

    - Fix an infinite loop condition on a crafted 'xz'       archive file. This was reported by Dimitri Kirchner       and Goulven Guiheux. CVE-2015-2668.

    - Fix compilation error after ./configure
      --disable-pthreads. Reported and fix suggested by John       E. Krokes.

    - Apply upstream patch for possible heap overflow in       Henry Spencer's regex library. CVE-2015-2305.

    - Fix crash in upx decoder with crafted file. Discovered       and patch supplied by Sebastian Andrzej Siewior.
      CVE-2015-2170.

    - Fix segfault scanning certain HTML files. Reported       with sample by Kai Risku.

    - Improve detections within xar/pkg files.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.7. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists in the pefromupx() function     in upx.c. A remote attacker can exploit this flaw, via a     specially crafted file, to crash the application.
    (CVE-2015-2170)

  - An unspecified flaw exists in the yc_poly_emulator()     function in yc.c. A remote attacker can exploit this     flaw, via a specially crafted y0da cryptor file, to     cause an infinite loop and application hang.
    (CVE-2015-2221)

  - An unspecified flaw exists in the cli_scanpe() function     in pe.c. A remote attacker can exploit this, via a     specially crafted petite packer file, to crash the     program. (CVE-2015-2222)

  - An integer overflow condition exists in the bundled     Henry Spencer regex library in the regcomp() function in     regcomp.c due to improper validation of user-supplied     input. A remote attacker can exploit this to cause a     buffer overflow, resulting in a denial of service or the     execution of arbitrary code. (CVE-2015-2305)

  - An unspecified flaw exists when handling specially     crafted xz archive files. A remote attacker can exploit     this to cause an infinite loop. (CVE-2015-2668)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2594-1 advisory.

    It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use     this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.

    In the default installation, attackers would be isolated by the ClamAV AppArmor profile.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in clamav :

Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior (CVE-2015-2221).

Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior (CVE-2015-2222).

Fix an infinite loop condition on a crafted xz archive file. This was reported by Dimitri Kirchner and Goulven Guiheux (CVE-2015-2668).

Apply upstream patch for possible heap overflow in Henry Spencer's regex library (CVE-2015-2305).

Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior (CVE-2015-2170).

The updated packages provides a solution for these security issues.

ID	Name	Product	Family	Severity
9260	ClamAV < 0.98.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
87708	GLSA-201512-08 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
83976	Amazon Linux AMI : clamav (ALAS-2015-537)	Nessus	Amazon Linux Local Security Checks	medium
83888	Debian DLA-233-1 : clamav security and upstream version update	Nessus	Debian Local Security Checks	high
83558	openSUSE Security Update : clamav (openSUSE-2015-366)	Nessus	SuSE Local Security Checks	medium
83555	FreeBSD : clamav -- multiple vulnerabilities (3d0428b2-fdfb-11e4-894f-d050996490d0)	Nessus	FreeBSD Local Security Checks	medium
83461	SuSE 11.3 Security Update : clamav (SAT Patch Number 10664)	Nessus	SuSE Local Security Checks	medium
83386	Fedora 20 : clamav-0.98.7-1.fc20 (2015-7378)	Nessus	Fedora Local Security Checks	medium
83352	ClamAV < 0.98.7 Multiple Vulnerabilities	Nessus	Misc.	medium
83255	Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-2594-1)	Nessus	Ubuntu Local Security Checks	medium
83245	Mandriva Linux Security Advisory : clamav (MDVSA-2015:221)	Nessus	Mandriva Local Security Checks	medium
83227	Fedora 22 : clamav-0.98.7-1.fc22 (2015-7346)	Nessus	Fedora Local Security Checks	medium
83226	Fedora 21 : clamav-0.98.7-1.fc21 (2015-7334)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-2222

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium