Update to 0.97.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ClamAV 0.97.8 addresses several reported potential security bugs.

The remote host is affected by the vulnerability described in GLSA-201405-08 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted file, leading to       arbitrary code execution or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This release of clamav provides version 0.97.8 and fixes several potential security issues (bnc#816865) :

  - Fix heap corruption. (CVE-2013-2020)

  - Fix overflow due to PDF key length computation.
    (CVE-2013-2021)

It was discovered that ClamAV would incorrectly parse a UPX-packed executable, leading to possible inappropriate heap reads. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2020)

It was discovered that ClamAV would incorrectly parse a PDF document, potentially writing beyond the size of a static array. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2021).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.2. It is, therefore, affected by the following vulnerabilities :

  - Two vulnerabilities exist in the included ClamAV     software, the most serious of which could allow an     attacker to execute arbitrary code remotely.
    (CVE-2013-2020 / CVE-2013-2021)

  - Three vulnerabilities exist in the included PostgreSQL     software, the most serious of which could result in     data corruption or privilege escalation.
    (CVE-2013-1899 / CVE-2013-1900 / CVE-2013-1901)

  - Multiple cross-site scripting issues exist in the     included Wiki Server software (CVE-2013-1034)

Fix 963920 Update to 0.97.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

According to its version, the ClamAV clamd antivirus daemon on the remote host is earlier than 0.97.8 and is, therefore, potentially affected by the following vulnerabilities :

  - An overflow condition exists in the 'getsisstring()'     function in 'libclamav/sis.c' when handling SIS content.
    This flaw reportedly only affects GNU/Linux.
    (Issue 6808)

  - A heap overflow exists in the 'libclamav/pdf.c' when     handling a specially crafted encrypted PDF file.  This     flaw reportedly affects ClamAV 0.97.1 - 0.97.7 only.
    (Issue 7053)

  - A heap overflow exists in 'libclamav/pe.c' that is     triggered when handling a specially crafted UPX-packed     executable.  (Issue 7055)

New clamav version 0.97.8 (bnc#816865) :

  - CVE-2013-2020: Fix heap corruption

  - CVE-2013-2021: Fix overflow due to PDF key length     computation.

This update contains clamav 0.97.8 which fixes security issues (bnc#816865) :

  - Fix heap corruption. (CVE-2013-2020)

  - Fix overflow due to PDF key length computation.
    (CVE-2013-2021)

Versions of ClamAV earlier than 0.97.8 are potentially affected by the following vulnerabilities : 

 - An overflow condition in 'libclamav/pdf.c' may be triggered as user-supplied input is not properly validated when handling a specially crafted encrypted PDF file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2013-2021)

 - An overflow condition in 'libclamav/pe.c' may be triggered as user-supplied input is not properly validated when handling a specially crafted UPX-packed executable file. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2013-2020)

ID	Name	Product	Family	Published	Updated	Severity
66454	Fedora 18 : clamav-0.97.8-1.fc18 (2013-8047)	Nessus	Fedora Local Security Checks	5/16/2013	1/11/2021	medium
66286	Mandriva Linux Security Advisory : clamav (MDVSA-2013:159)	Nessus	Mandriva Local Security Checks	5/1/2013	1/6/2021	medium
74051	GLSA-201405-08 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/19/2014	1/6/2021	critical
66953	SuSE 11.2 / 11.3 Security Update : clamav (SAT Patch Numbers 7821 / 7915)	Nessus	SuSE Local Security Checks	6/21/2013	1/19/2021	medium
66314	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 / 13.04 : clamav vulnerabilities (USN-1816-1)	Nessus	Ubuntu Local Security Checks	5/4/2013	9/19/2019	medium
69932	Mac OS X : OS X Server < 2.2.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/17/2013	7/14/2018	high
67289	Fedora 19 : clamav-0.97.8-2.fc19 (2013-10853)	Nessus	Fedora Local Security Checks	7/12/2013	1/11/2021	medium
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	9/13/2013	5/28/2024	critical
66308	ClamAV < 0.97.8 Multiple Vulnerabilities	Nessus	Misc.	5/3/2013	11/27/2019	medium
67294	Fedora 18 : clamav-0.97.8-2.fc18 (2013-10953)	Nessus	Fedora Local Security Checks	7/12/2013	1/11/2021	medium
75004	openSUSE Security Update : clamav (openSUSE-SU-2013:0881-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
66956	SuSE 10 Security Update : clamav (ZYPP Patch Number 8606)	Nessus	SuSE Local Security Checks	6/21/2013	1/19/2021	medium
67295	Fedora 17 : clamav-0.97.8-2.fc17 (2013-10980)	Nessus	Fedora Local Security Checks	7/12/2013	1/11/2021	medium
6782	ClamAV < 0.97.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	5/2/2013	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

critical

medium

medium

high

medium

critical

medium

medium

medium

medium

medium

medium