A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

The version of clamav installed on the remote host is prior to 0.103.9-1.55. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1820 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of clamav installed on the remote host is prior to 0.103.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2233 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-331 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3456-1 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3435-1 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3544 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9f948bec13 advisory.

    CVE-2023-20197 ClamAV File Scanning Infinite Loop Denial of Service Vulnerability

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-bf72d8833e advisory.

    CVE-2023-20197 ClamAV File Scanning Infinite Loop Denial of Service Vulnerability

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6303-2 advisory.

    USN-6303-1 fixed a vulnerability in ClamAV. This update provides the corresponding update for Ubuntu 14.04     LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6303-1 advisory.

    It was discovered that ClamAV incorrectly handled parsing HFS+ files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 51a59f36-3c58-11ee-b32e-080027f5fec9 advisory.

  - A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could     allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected     device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which     may result in a loop condition that could cause the affected software to stop responding. An attacker     could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on     an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to     stop responding, resulting in a DoS condition on the affected software and consuming available system     resources. For a description of this vulnerability, see the ClamAV blog . (CVE-2023-20197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181218	Amazon Linux AMI : clamav (ALAS-2023-1820)	Nessus	Amazon Linux Local Security Checks	high
181160	Amazon Linux 2 : clamav (ALAS-2023-2233)	Nessus	Amazon Linux Local Security Checks	high
181142	Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2023-331)	Nessus	Amazon Linux Local Security Checks	high
180465	ClamAV < 0.103.9 / 1.0.x < 1.0.2 / 1.1.x < 1.1.1 DoS	Nessus	Misc.	high
180316	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2023:3456-1)	Nessus	SuSE Local Security Checks	high
180295	SUSE SLES12 Security Update : clamav (SUSE-SU-2023:3435-1)	Nessus	SuSE Local Security Checks	high
180207	Debian DLA-3544-1 : clamav - LTS security update	Nessus	Debian Local Security Checks	high
180200	Fedora 37 : clamav (2023-9f948bec13)	Nessus	Fedora Local Security Checks	high
180013	Fedora 38 : clamav (2023-bf72d8833e)	Nessus	Fedora Local Security Checks	high
180011	Ubuntu 16.04 ESM / 18.04 ESM : ClamAV vulnerability (USN-6303-2)	Nessus	Ubuntu Local Security Checks	high
180008	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : ClamAV vulnerability (USN-6303-1)	Nessus	Ubuntu Local Security Checks	high
179944	FreeBSD : clamav -- Possible denial of service vulnerability in the HFS+ file parser (51a59f36-3c58-11ee-b32e-080027f5fec9)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2023-20197

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high