Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.94 release, including :

A vulnerability in ClamAV's chm-parser allowed remote attackers to cause a denial of service (application crash) via a malformed CHM file (CVE-2008-1389).

A vulnerability in libclamav would allow attackers to cause a denial of service via vectors related to an out-of-memory condition (CVE-2008-3912).

Multiple memory leaks were found in ClamAV that could possibly allow attackers to cause a denial of service via excessive memory consumption (CVE-2008-3913).

A number of unspecified vulnerabilities in ClamAV were reported that have an unknown impact and attack vectors related to file descriptor leaks (CVE-2008-3914).

Other bugs have also been corrected in 0.94 which is being provided with this update. Because this new version has increased the major of the libclamav library, updated dependent packages are also being provided.

Update :

The previous update had experimental support enabled, which caused ClamAV to report the version as 0.94-exp rather than 0.94, causing ClamAV to produce bogus warnings about the installation being outdated. This update corrects that problem.

This version update of clamav to 0.94 fixes numerous problems, including the following security issues :

  - Fix possible invalid memory access. (CVE-2008-1389)

  - Fix out-of-memory null dereference. (CVE-2008-3912)

  - Fix error path memory leaks and file descriptor leaks.
    (CVE-2008-3913, CVE-2008-3914)

Security fixes from upstream 0.94 and 0.94.1: CVE-2008-3912 (#461461):
Multiple out-of-memory NULL pointer dereferences CVE-2008-3913 (#461461): Fix memory leak in the error code path in freshclam CVE-2008-3914 (#461461): File descriptor leak on the error code path CVE-2008-5050 (#470783): get_unicode_name() off-by-one buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94. Such versions are affected by one or more of the following issues :

  - A segmentation fault can occur when processing corrupted     LZH files. (Bug #1052)

  - Invalid memory access errors in 'libclamav/chmunpack.c'     when processing malformed CHM files may lead to a     crash. (Bug #1089)

  - An out-of-memory null dereference issue exists in     'libclamav/message.c' / 'libclamav/mbox.c'. (Bug #1141)

  - Possible error path memory leaks exist in     'freshclam/manager.c'. (Bug #1141)

  - There is an invalid close on error path in     'shared/tar.c'. (Bug #1141)

  - There are multiple file descriptor leaks involving the     'error path' in 'libclamav/others.c' and     'libclamav/sis.c'. (Bug #1141)

This version update to 0.94 fixes numerous problems including some security relevant ones (CVE-2008-3912, CVE-2008-1389, CVE-2008-3913, CVE-2008-3914).

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

This version update to 0.94 fixes numerous problems including some security relevant ones. (CVE-2008-3912 / CVE-2008-1389 / CVE-2008-3913 / CVE-2008-3914)

Hanno Boeck reports :

A fuzzing test showed weakness in the chm parser of clamav, which can possibly be exploited. The clamav team has disabled the chm module in older versions though freshclam updates and has released 0.94 with a fixed parser.

The remote host is affected by the vulnerability described in GLSA-200809-18 (ClamAV: Multiple Denials of Service)

    Hanno boeck reported an error in libclamav/chmunpack.c when processing     CHM files (CVE-2008-1389). Other unspecified vulnerabilities were also     reported, including a NULL pointer dereference in libclamav     (CVE-2008-3912), memory leaks in freshclam/manager.c (CVE-2008-3913),     and file descriptor leaks in libclamav/others.c and libclamav/sis.c     (CVE-2008-3914).
  Impact :

    A remote attacker could entice a user or automated system to scan a     specially crafted CHM, possibly resulting in a Denial of Service     (daemon crash). The other attack vectors mentioned above could also     result in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Security fixes from upstream 0.94 and 0.94.1: CVE-2008-1389 (#461461):
Invalid memory access in the CHM unpacker CVE-2008-3912 (#461461):
Multiple out-of-memory NULL pointer dereferences CVE-2008-3913 (#461461): Fix memory leak in the error code path in freshclam CVE-2008-3914 (#461461): Multiple file descriptor leaks on the error code path CVE-2008-5050 (#470783): get_unicode_name() off-by-one buffer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.  Such versions are affected by one or more of the following issues : 

  - A segmentation fault can occur when processing corrupted LZH files. (Bug #1052)

  - Invalid memory access errors in 'libclamav/chmunpack.c' when processing malformed CHM files may lead to a crash. (Bug #1089)

  - An out-of-memory null dereference issue exists in 'libclamav/message.c' / 'libclamav/mbox.c'. (Bug #1141)

  - Possible error path memory leaks exist in 'freshclam/manager.c'. (Bug #1141)

  - There is an invalid close on error path in 'shared/tar.c'. (Bug #1141)

  - There are multiple file descriptor leaks involving the 'error path' in 'libclamav/others.c' and 'libclamav/sis.c'. (Bug #1141).

The remote host is running ClamAV client.

This version of ClamAV is vulnerable to a flaw within the 'libclamav/chmunpack.c' file.  Specifically, when handling malformed '.chm' files, the application fails to adequately parse the file.  An attacker sending a malformed .chm file to a server running ClamAV would be able to crash the service.

ID	Name	Product	Family	Published	Updated	Severity
38032	Mandriva Linux Security Advisory : clamav (MDVSA-2008:189-1)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	critical
41239	SuSE9 Security Update : clamav (YOU Patch Number 12236)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
34775	Fedora 8 : clamav-0.92.1-4.fc8 (2008-9651)	Nessus	Fedora Local Security Checks	11/16/2008	1/11/2021	critical
35087	ClamAV < 0.94 Multiple Vulnerabilities	Nessus	Gain a shell remotely	12/11/2008	11/15/2018	high
39931	openSUSE Security Update : clamav (clamav-181)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	critical
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	10/10/2008	5/28/2024	critical
34167	SuSE 10 Security Update : clamav (ZYPP Patch Number 5579)	Nessus	SuSE Local Security Checks	9/11/2008	1/14/2021	critical
34189	FreeBSD : clamav -- CHM Processing Denial of Service (da5c4072-8082-11dd-9c8c-001c2514716c)	Nessus	FreeBSD Local Security Checks	9/12/2008	1/6/2021	medium
34166	openSUSE 10 Security Update : clamav (clamav-5578)	Nessus	SuSE Local Security Checks	9/11/2008	1/14/2021	critical
34299	GLSA-200809-18 : ClamAV: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	9/26/2008	1/6/2021	critical
34774	Fedora 9 : clamav-0.93.3-2.fc9 (2008-9644)	Nessus	Fedora Local Security Checks	11/16/2008	1/11/2021	critical
4787	ClamAV < 0.94 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	12/12/2008	3/6/2019	high
4642	ClamAV < 0.93.1 memcpy() .chm File Handling DoS (deprecated)	Nessus Network Monitor	Web Clients	9/4/2008	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

critical

critical

medium

critical

critical

critical

high

high