Detections
Analytics
ClamAV < 0.92.0 PE File Handling Integer Overflow (deprecated)
high Nessus Network Monitor Plugin ID 4321
Synopsis
The remote host is vulnerable to a buffer overflow.Description
The remote host is running the ClamAV antivirus client.This version of ClamAV is vulnerable to a remote integer overflow due to a content-parsing flaw when handling malformed PE files. An attacker exploiting this flaw would only need the ability to send a malformed attachment to a system protected by ClamAV. Successful exploitation would result in the attacker overwriting critical memory blocks and either crashing the service or executing arbitrary code.
Solution
Upgrade to version 0.92.0 or higher.See Also
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=634
Plugin Details
Severity: High
ID: 4321
Family: Web Clients
Published: 12/19/2007
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.3
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Reference Information
CVE: CVE-2007-6335, CVE-2007-6336, CVE-2007-6337, CVE-2007-6595, CVE-2007-6596