A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3983 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3983-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Lucas Kanashiro     December 04, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : clamav     Version        : 1.0.7+dfsg-1~deb11u1     CVE ID         : CVE-2024-20505 CVE-2024-20506     Debian Bug     : #1080962

    Two vulnerabilities were found in ClamAV, an antivirus toolkit for Unix.

    CVE-2024-20505

        Affected versions could allow an unauthenticated, remote attacker to cause         a denial of service (DoS) condition on an affected device. The         vulnerability is due to an out of bounds read. An attacker could exploit         this vulnerability by submitting a crafted PDF file to be scanned by ClamAV         on an affected device. An exploit could allow the attacker to terminate the         scanning process.

    CVE-2024-20506

        Affected versions could allow an authenticated, local attacker to corrupt         critical system files. The vulnerability is due to allowing the ClamD         process to write to its log file while privileged without checking if the         logfile has been replaced with a symbolic link. An attacker could exploit         this vulnerability if they replace the ClamD log file with a symlink to a         critical system file and then find a way to restart the ClamD process. An         exploit could allow the attacker to corrupt a critical system file by         appending ClamD log messages after restart.

    ClamAV was updated to version 1.0.7+dfsg-1~deb10u1. Due to the library soname     bump, the reverse dependencies of libclamav9 were rebuilt against libclamav11.
    The following source packages were updated:

    - - c-icap-modules/1:0.5.4-2+deb11u1
    - - cyrus-imapd/3.2.6-2+deb11u3
    - - havp/0.93-2+deb11u1
    - - pg-snakeoil/1.3-2+deb11u1
    - - libclamunrar/1.0.3-1~deb11u1

    For Debian 11 bullseye, these problems have been fixed in version     1.0.7+dfsg-1~deb11u1.

    We recommend that you upgrade your clamav packages.

    For the detailed security status of clamav please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/clamav

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of clamav installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20506 advisory.

  - A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior     versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and     0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system     files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged     without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this     vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a     way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by     appending ClamD log messages after restart. (CVE-2024-20506)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0d7eb64d90 advisory.

    Update to 1.0.7

    * CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as     to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to     corrupt system files.
    * CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a     denial-of-service (DoS) condition.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-737 advisory.

    A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior     versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and     0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of     service (DoS) condition on an affected device.The vulnerability is due to an out of bounds read. An     attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an     affected device. An exploit could allow the attacker to terminate the scanning process. (CVE-2024-20505)

    A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior     versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and     0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system     files.The vulnerability is due to allowing the ClamD process to write to its log file while privileged     without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this     vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a     way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by     appending ClamD log messages after restart. (CVE-2024-20506)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of clamav installed on the remote host is prior to 0.103.12-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2644 advisory.

    A vulnerability in the PDF parsing module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior     versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and     0.103.11 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of     service (DoS) condition on an affected device.The vulnerability is due to an out of bounds read. An     attacker could exploit this vulnerability by submitting a crafted PDF file to be scanned by ClamAV on an     affected device. An exploit could allow the attacker to terminate the scanning process. (CVE-2024-20505)

    A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior     versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and     0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system     files.The vulnerability is due to allowing the ClamD process to write to its log file while privileged     without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this     vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a     way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by     appending ClamD log messages after restart. (CVE-2024-20506)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The ClamAV reported version is < 103.12, 1.0.x < 1.0.7, 1.1.0 < x < 1.3.2, or 1.4.0 < 1.4.1  It is, therefore, affected by a vulnerability in the ClamD service module, where an attacker could to corrupt a critical system file by appending ClamD log messages after restart.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3306-1 advisory.

    - Update to version 0.103.12
    - CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. (bsc#1230162)
    - CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. (bsc#1230161)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3305-1 advisory.

    - Update to version 0.103.12
    - CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. (bsc#1230162)
    - CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. (bsc#1230161)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7011-2 advisory.

    USN-7011-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for     Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7011-1 advisory.

    It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2024-20505)

    It was discovered that ClamAV incorrectly handled logfile privileges. A local attacker could use this     issue to cause ClamAV to overwrite arbitrary files, possibly leading to privilege escalation.
    (CVE-2024-20506)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-05d7ee197e advisory.

    Update to 1.0.7

    * CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as     to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to     corrupt system files.
    * CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a     denial-of-service (DoS) condition.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e8f7a74693 advisory.

    Update to 1.0.7

    * CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as     to prevent an attacker with existing access to the 'clamd' or 'freshclam' services from using a symlink to     corrupt system files.
    * CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a     denial-of-service (DoS) condition.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3228-1 advisory.

    - Update to version 0.103.12
    - CVE-2024-20506: Disable symlinks following to prevent an attacker to corrupt system files. (bsc#1230162)
    - CVE-2024-20505: Fixed possible out-of-bounds read bug in the PDF file parser. (bsc#1230161)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 996518f3-6ef9-11ef-b01b-08002784c58d advisory.

    The ClamAV project  reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
212107	Debian dla-3983 : clamav - security update	Nessus	Debian Local Security Checks	medium
211743	CBL Mariner 2.0 Security Update: clamav (CVE-2024-20506)	Nessus	MarinerOS Local Security Checks	medium
211058	Fedora 41 : clamav (2024-0d7eb64d90)	Nessus	Fedora Local Security Checks	medium
208977	Amazon Linux 2023 : clamav, clamav-data, clamav-devel (ALAS2023-2024-737)	Nessus	Amazon Linux Local Security Checks	medium
208113	Amazon Linux 2 : clamav (ALAS-2024-2644)	Nessus	Amazon Linux Local Security Checks	medium
207495	ClamAV < 0.103.12, 1.0.0 < 1.0.7, 1.1.0 < 1.3.2, 1.4.0 < 1.4.1 System File Corruption	Nessus	Misc.	medium
207423	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2024:3306-1)	Nessus	SuSE Local Security Checks	medium
207414	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : clamav (SUSE-SU-2024:3305-1)	Nessus	SuSE Local Security Checks	medium
207340	Ubuntu 16.04 LTS / 18.04 LTS : ClamAV vulnerabilities (USN-7011-2)	Nessus	Ubuntu Local Security Checks	medium
207280	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : ClamAV vulnerabilities (USN-7011-1)	Nessus	Ubuntu Local Security Checks	medium
207276	Fedora 39 : clamav (2024-05d7ee197e)	Nessus	Fedora Local Security Checks	medium
207268	Fedora 40 : clamav (2024-e8f7a74693)	Nessus	Fedora Local Security Checks	medium
207219	SUSE SLES12 Security Update : clamav (SUSE-SU-2024:3228-1)	Nessus	SuSE Local Security Checks	medium
206961	FreeBSD : clamav -- Multiple vulnerabilities (996518f3-6ef9-11ef-b01b-08002784c58d)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2024-20506

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium