A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-615 advisory.

    A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker     to cause a denial of service (DoS) condition on an affected device.

    This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result     in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file     containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow     the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the     affected software and consuming available system resources.

    For a description of this vulnerability, see the ClamAV blog . (CVE-2024-20290)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6636-1 advisory.

    It was discovered that ClamAV incorrectly handled parsing certain OLE2 files. A remote attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20290)

    Amit Schendel discovered that the ClamAV ClamD service incorrectly handled the VirusEvent feature. An     attacker able to connect to ClamD could possibly use this issue to execute arbitrary code.
    (CVE-2024-20328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3439911df6 advisory.

    Update to 1.0.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c42cf0e576 advisory.

    Update to 1.0.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 68ae70c5-c5e5-11ee-9768-08002784c58d advisory.

  - A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker     to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an     incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An     attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be     scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV     scanning process to terminate, resulting in a DoS condition on the affected software and consuming     available system resources. For a description of this vulnerability, see the ClamAV blog .
    (CVE-2024-20290)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196922	Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2024-615)	Nessus	Amazon Linux Local Security Checks	high
190581	Ubuntu 23.10 : ClamAV vulnerabilities (USN-6636-1)	Nessus	Ubuntu Local Security Checks	high
190507	Fedora 39 : clamav (2024-3439911df6)	Nessus	Fedora Local Security Checks	high
190437	Fedora 38 : clamav (2024-c42cf0e576)	Nessus	Fedora Local Security Checks	high
190352	ClamAV 1.0.0 < 1.0.4, 1.1.x, 1.2.0 < 1.2.1 DoS	Nessus	Misc.	high
190129	FreeBSD : clamav -- Multiple vulnerabilities (68ae70c5-c5e5-11ee-9768-08002784c58d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-20290

high

Tenable Plugins

high

high

high

high

high

high