A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

The version of clamav installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20328 advisory.

  - A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary     commands with the privileges of the application service account.The vulnerability is due to unsafe     handling of file names. A local attacker could exploit this vulnerability by supplying a file name     containing command-line sequences. When processed on a system using configuration options for the     VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has     released software updates that address this vulnerability. There are no workarounds that address this     vulnerability. (CVE-2024-20328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6636-1 advisory.

    It was discovered that ClamAV incorrectly handled parsing certain OLE2 files. A remote attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20290)

    Amit Schendel discovered that the ClamAV ClamD service incorrectly handled the VirusEvent feature. An     attacker able to connect to ClamD could possibly use this issue to execute arbitrary code.
    (CVE-2024-20328)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3439911df6 advisory.

    Update to 1.0.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c42cf0e576 advisory.

    Update to 1.0.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The ClamAV reported version is 0.104.x, 0.105.x, 1.0.x < 1.0.4, 1.1.x or 1.2.x < 1.2.1. It is, therefore, affected by a vulnerability in the “VirusEvent” feature, where an attacker could manipulate the '%f' format string parameter to inject malicious commands. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 68ae70c5-c5e5-11ee-9768-08002784c58d advisory.

  - A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker     to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an     incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An     attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be     scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV     scanning process to terminate, resulting in a DoS condition on the affected software and consuming     available system resources. For a description of this vulnerability, see the ClamAV blog .
    (CVE-2024-20290)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201783	CBL Mariner 2.0 Security Update: clamav (CVE-2024-20328)	Nessus	MarinerOS Local Security Checks	medium
190581	Ubuntu 23.10 : ClamAV vulnerabilities (USN-6636-1)	Nessus	Ubuntu Local Security Checks	high
190507	Fedora 39 : clamav (2024-3439911df6)	Nessus	Fedora Local Security Checks	high
190437	Fedora 38 : clamav (2024-c42cf0e576)	Nessus	Fedora Local Security Checks	high
190351	ClamAV 0.104.x, 0.105.x, 1.0.0 < 1.0.4, 1.1.x, 1.2.0 < 1.2.1 RCE	Nessus	Misc.	medium
190129	FreeBSD : clamav -- Multiple vulnerabilities (68ae70c5-c5e5-11ee-9768-08002784c58d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2024-20328

medium

Tenable Plugins

medium

high

high

high

medium

high