Clam Anti-Virus ClamAV Mac OS X Command Execution Vulnerability
BID:13795
Info
Clam Anti-Virus ClamAV Mac OS X Command Execution Vulnerability
| Bugtraq ID: | 13795 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2005 12:00AM |
| Updated: | Mar 08 2007 12:25AM |
| Credit: | Discovery is credited to Tim <[email protected]> and Kevin Amorin. |
| Vulnerable: |
Clam Anti-Virus ClamAV 0.84 rc2 Clam Anti-Virus ClamAV 0.84 rc1 Clam Anti-Virus ClamAV 0.83 Clam Anti-Virus ClamAV 0.82 Clam Anti-Virus ClamAV 0.81 Clam Anti-Virus ClamAV 0.80 rc4 |
| Not Vulnerable: |
Clam Anti-Virus ClamAV 0.85.1 Clam Anti-Virus ClamAV 0.85 Clam Anti-Virus ClamAV 0.84 |
Discussion
Clam Anti-Virus ClamAV Mac OS X Command Execution Vulnerability
Clam Anti-Virus ClamAV running on Mac OS X is affected by a command-execution vulnerability.
Reportedly, when the application handles a suspected infected file, it cannot be removed. The application may attempt to copy the file to another location using the Mac OS X 'ditto' utility. Since the 'ditto' utility is called in an insecure manner and since the responsible function fails to sanitize the filename, an attacker can include arbitrary commands in the filename that will be executed in the context of ClamAV.
An attacker can exploit this issue to gain unauthorized access to an affected computer. Note that exploitation is possible only when a malicious file is copied.
ClamAV versions 0.80rc4 to 0.84rc2 are affected by this issue.
Clam Anti-Virus ClamAV running on Mac OS X is affected by a command-execution vulnerability.
Reportedly, when the application handles a suspected infected file, it cannot be removed. The application may attempt to copy the file to another location using the Mac OS X 'ditto' utility. Since the 'ditto' utility is called in an insecure manner and since the responsible function fails to sanitize the filename, an attacker can include arbitrary commands in the filename that will be executed in the context of ClamAV.
An attacker can exploit this issue to gain unauthorized access to an affected computer. Note that exploitation is possible only when a malicious file is copied.
ClamAV versions 0.80rc4 to 0.84rc2 are affected by this issue.
Exploit / POC
Clam Anti-Virus ClamAV Mac OS X Command Execution Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Clam Anti-Virus ClamAV Mac OS X Command Execution Vulnerability
Solution:
ClamAV 0.84 and subsequent versions are not affected by this issue.
Clam Anti-Virus ClamAV 0.80 rc4
Clam Anti-Virus ClamAV 0.81
Clam Anti-Virus ClamAV 0.82
Clam Anti-Virus ClamAV 0.83
Clam Anti-Virus ClamAV 0.84 rc2
Clam Anti-Virus ClamAV 0.84 rc1
Solution:
ClamAV 0.84 and subsequent versions are not affected by this issue.
Clam Anti-Virus ClamAV 0.80 rc4
-
Clam Anti-Virus clamav-0.85.1.tar.gz
http://prdownloads.sourceforge.net/clamav/clamav-0.85.1.tar.gz?downloa d
Clam Anti-Virus ClamAV 0.81
-
Clam Anti-Virus clamav-0.85.1.tar.gz
http://prdownloads.sourceforge.net/clamav/clamav-0.85.1.tar.gz?downloa d
Clam Anti-Virus ClamAV 0.82
-
Clam Anti-Virus clamav-0.85.1.tar.gz
http://prdownloads.sourceforge.net/clamav/clamav-0.85.1.tar.gz?downloa d
Clam Anti-Virus ClamAV 0.83
-
Clam Anti-Virus clamav-0.85.1.tar.gz
http://prdownloads.sourceforge.net/clamav/clamav-0.85.1.tar.gz?downloa d
Clam Anti-Virus ClamAV 0.84 rc2
-
Clam Anti-Virus clamav-0.85.1.tar.gz
http://prdownloads.sourceforge.net/clamav/clamav-0.85.1.tar.gz?downloa d
Clam Anti-Virus ClamAV 0.84 rc1
-
Clam Anti-Virus clamav-0.85.1.tar.gz
http://prdownloads.sourceforge.net/clamav/clamav-0.85.1.tar.gz?downloa d
References
Clam Anti-Virus ClamAV Mac OS X Command Execution Vulnerability
References:
References:
- ClamAV Homepage (Clam Anti-Virus)
- ClamAV: Local Privilege Escalation Vulnerability On MacOS (Tim Morgan)