ClamAV UPX Compressed Executable Buffer Overflow Vulnerability

Bugtraq ID:	14866
Class:	Boundary Condition Error
CVE:	CVE-2005-2920
Remote:	Yes
Local:	No
Published:	Sep 16 2005 12:00AM
Updated:	Dec 20 2006 10:37PM
Credit:	Discovery is credited to an anonymous source.
Vulnerable:	Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Clam Anti-Virus ClamAV 0.86.2 Clam Anti-Virus ClamAV 0.86 .1 Clam Anti-Virus ClamAV 0.86 Clam Anti-Virus ClamAV 0.85.1 Clam Anti-Virus ClamAV 0.85 Clam Anti-Virus ClamAV 0.84 rc2 Clam Anti-Virus ClamAV 0.84 rc1 Clam Anti-Virus ClamAV 0.84 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 alpha + Debian Linux 3.1 Clam Anti-Virus ClamAV 0.83 Clam Anti-Virus ClamAV 0.82 Clam Anti-Virus ClamAV 0.81 + Gentoo Linux Clam Anti-Virus ClamAV 0.80 rc4 Clam Anti-Virus ClamAV 0.80 rc3 Clam Anti-Virus ClamAV 0.80 rc2 Clam Anti-Virus ClamAV 0.80 rc1 Clam Anti-Virus ClamAV 0.80 Clam Anti-Virus ClamAV 0.75.1 Clam Anti-Virus ClamAV 0.70 Clam Anti-Virus ClamAV 0.68 -1 Clam Anti-Virus ClamAV 0.68 Clam Anti-Virus ClamAV 0.67 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4 Clam Anti-Virus ClamAV 0.65 Clam Anti-Virus ClamAV 0.60 Clam Anti-Virus ClamAV 0.54 Clam Anti-Virus ClamAV 0.53 Clam Anti-Virus ClamAV 0.52 Clam Anti-Virus ClamAV 0.51
Not Vulnerable:	Clam Anti-Virus ClamAV 0.87

ClamAV UPX Compressed Executable Buffer Overflow Vulnerability

ClamAV is prone to a remote buffer-overflow vulnerability. This condition occurs when the program processes malformed UPX-compressed executables.

Successful exploitation may result in the execution of arbitrary code in the context of the application.

ClamAV UPX Compressed Executable Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ClamAV UPX Compressed Executable Buffer Overflow Vulnerability

Solution:

Please see the referenced vendor advisories for more information.


Clam Anti-Virus ClamAV 0.51

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.52

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.53

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.54

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.60

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.65

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.67

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.68

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.68 -1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.70

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.75.1

• Mandriva clamav-0.87-0.1.101mdk.i586.rpm
  Mandrakelinux 10.1:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-0.87-0.1.101mdk.x86_64.rpm
  Mandrakelinux 10.1/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-db-0.87-0.1.101mdk.i586.rpm
  Mandrakelinux 10.1:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-db-0.87-0.1.101mdk.x86_64.rpm
  Mandrakelinux 10.1/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-milter-0.87-0.1.101mdk.i586.rpm
  Mandrakelinux 10.1:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-milter-0.87-0.1.101mdk.x86_64.rpm
  Mandrakelinux 10.1/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamd-0.87-0.1.101mdk.i586.rpm
  Mandrakelinux 10.1:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamd-0.87-0.1.101mdk.x86_64.rpm
  Mandrakelinux 10.1/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva lib64clamav1-0.87-0.1.101mdk.x86_64.rpm
  Mandrakelinux 10.1/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva lib64clamav1-devel-0.87-0.1.101mdk.x86_64.rpm
  Mandrakelinux 10.1/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva libclamav1-0.87-0.1.101mdk.i586.rpm
  Mandrakelinux 10.1:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva libclamav1-devel-0.87-0.1.101mdk.i586.rpm
  Mandrakelinux 10.1:
  http://www1.mandrivalinux.com/en/ftp.php3

Clam Anti-Virus ClamAV 0.80 rc3

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc2

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc4

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.81

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.82

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.83

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638


• Mandriva clamav-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-db-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-db-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-milter-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-milter-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamd-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamd-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva lib64clamav1-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva libclamav1-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva libclamav1-devel-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3

Clam Anti-Virus ClamAV 0.84 rc2

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638


• Debian clamav-base_0.84-2.sarge.4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.84 -2.sarge.4_all.deb


• Debian clamav-daemon_0.84-2.sarge.4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_alpha.deb


• Debian clamav-daemon_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_arm.deb


• Debian clamav-daemon_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_hppa.deb


• Debian clamav-daemon_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_i386.deb


• Debian clamav-daemon_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_m68k.deb


• Debian clamav-daemon_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_mips.deb


• Debian clamav-daemon_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_mipsel.deb


• Debian clamav-daemon_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_powerpc.deb


• Debian clamav-daemon_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_s390.deb


• Debian clamav-daemon_0.84-2.sarge.4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_sparc.deb


• Debian clamav-docs_0.84-2.sarge.4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.84 -2.sarge.4_all.deb


• Debian clamav-freshclam_0.84-2.sarge.4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_amd64.deb


• Debian clamav-freshclam_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_arm.deb


• Debian clamav-freshclam_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_hppa.deb


• Debian clamav-freshclam_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_i386.deb


• Debian clamav-freshclam_0.84-2.sarge.4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_ia64.deb


• Debian clamav-freshclam_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_m68k.deb


• Debian clamav-freshclam_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_mips.deb


• Debian clamav-freshclam_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_mipsel.deb


• Debian clamav-freshclam_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_powerpc.deb


• Debian clamav-freshclam_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_s390.deb


• Debian clamav-freshclam_0.84-2.sarge.4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_sparc.deb


• Debian clamav-milter_0.84-2.sarge.4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_alpha.deb


• Debian clamav-milter_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_arm.deb


• Debian clamav-milter_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_hppa.deb


• Debian clamav-milter_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_i386.deb


• Debian clamav-milter_0.84-2.sarge.4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_ia64.deb


• Debian clamav-milter_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_m68k.deb


• Debian clamav-milter_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_mips.deb


• Debian clamav-milter_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_mipsel.deb


• Debian clamav-milter_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_powerpc.deb


• Debian clamav-milter_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_s390.deb


• Debian clamav/libclamav1_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84- 2.sarge.4_i386.deb


• Debian clamav/libclamav1_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84- 2.sarge.4_mipsel.deb


• Debian clamav_0.84-2.sarge.4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_alpha.deb


• Debian clamav_0.84-2.sarge.4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_amd64.deb


• Debian clamav_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_arm.deb


• Debian clamav_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_hppa.deb


• Debian clamav_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_i386.deb


• Debian clamav_0.84-2.sarge.4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_ia64.deb


• Debian clamav_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_m68k.deb


• Debian clamav_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_mips.deb


• Debian clamav_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_mipsel.deb


• Debian clamav_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_powerpc.deb


• Debian clamav_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_s390.deb


• Debian clamav_0.84-2.sarge.4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_sparc.deb

Clam Anti-Virus ClamAV 0.84

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.84 rc1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.85

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.85.1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.86 .1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.86

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.86.2

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

ClamAV UPX Compressed Executable Buffer Overflow Vulnerability

References:

• 0.87 Release Notes (ClamAV)
  
• Clam AntiVirus Win32-UPX Buffer Overflow Vulnerability (iDEFENSE)
  
• Project Homepage (ClamAV)