ClamAV FSG Compressed Executable Infinite Loop Denial Of Service Vulnerability

Bugtraq ID:	14867
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-2919
Remote:	Yes
Local:	No
Published:	Sep 16 2005 12:00AM
Updated:	Dec 20 2006 10:38PM
Credit:	Discovery is credited to an anonymous source.
Vulnerable:	Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Clam Anti-Virus ClamAV 0.86.2 Clam Anti-Virus ClamAV 0.86 .1 Clam Anti-Virus ClamAV 0.86 Clam Anti-Virus ClamAV 0.85.1 Clam Anti-Virus ClamAV 0.85 Clam Anti-Virus ClamAV 0.84 rc2 Clam Anti-Virus ClamAV 0.84 rc1 Clam Anti-Virus ClamAV 0.84 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 alpha + Debian Linux 3.1 Clam Anti-Virus ClamAV 0.83 Clam Anti-Virus ClamAV 0.82 Clam Anti-Virus ClamAV 0.81 + Gentoo Linux Clam Anti-Virus ClamAV 0.80 rc4 Clam Anti-Virus ClamAV 0.80 rc3 Clam Anti-Virus ClamAV 0.80 rc2 Clam Anti-Virus ClamAV 0.80 rc1 Clam Anti-Virus ClamAV 0.80 Clam Anti-Virus ClamAV 0.70 Clam Anti-Virus ClamAV 0.68 -1 Clam Anti-Virus ClamAV 0.68 Clam Anti-Virus ClamAV 0.67 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4 Clam Anti-Virus ClamAV 0.65 Clam Anti-Virus ClamAV 0.60 Clam Anti-Virus ClamAV 0.54 Clam Anti-Virus ClamAV 0.53 Clam Anti-Virus ClamAV 0.52 Clam Anti-Virus ClamAV 0.51
Not Vulnerable:	Clam Anti-Virus ClamAV 0.87

ClamAV FSG Compressed Executable Infinite Loop Denial Of Service Vulnerability

ClamAV is prone to a remote denial-of-service vulnerability. This issue occurs when the application handles a malformed FSG-compressed executable.

Exploitation could cause the application to enter an infinite loop, resulting in a denial of service.

ClamAV FSG Compressed Executable Infinite Loop Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ClamAV FSG Compressed Executable Infinite Loop Denial Of Service Vulnerability

Solution:

Please see the referenced vendor advisories for more information.


Clam Anti-Virus ClamAV 0.51

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.52

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.53

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.54

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.60

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.65

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.67

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.68

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.68 -1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.70

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc3

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc2

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80 rc4

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.80

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638


• Trustix clamav-0.80-3tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix clamav-devel-0.80-3tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix clamav-0.87-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix clamav-0.87-1tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix clamav-0.87-1tr.i586.rpm
  Trustix Secure Linux 2.2
  http://www.trustix.org/errata/trustix-2.2/


• Trustix clamav-devel-0.87-1tr.i586.rpm
  Trustix Secure Linux 2.2
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix clamav-devel-0.87-1tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/

Clam Anti-Virus ClamAV 0.81

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.82

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.83

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638


• Mandriva clamav-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-db-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-db-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-milter-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamav-milter-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamd-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva clamd-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva lib64clamav1-0.87-0.1.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva libclamav1-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva libclamav1-devel-0.87-0.1.102mdk.i586.rpm
  Mandrakelinux 10.2:
  http://www1.mandrivalinux.com/en/ftp.php3

Clam Anti-Virus ClamAV 0.84 rc2

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638


• Debian clamav-base_0.84-2.sarge.4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.84 -2.sarge.4_all.deb


• Debian clamav-daemon_0.84-2.sarge.4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_alpha.deb


• Debian clamav-daemon_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_arm.deb


• Debian clamav-daemon_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_hppa.deb


• Debian clamav-daemon_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_i386.deb


• Debian clamav-daemon_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_m68k.deb


• Debian clamav-daemon_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_mips.deb


• Debian clamav-daemon_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_mipsel.deb


• Debian clamav-daemon_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_powerpc.deb


• Debian clamav-daemon_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_s390.deb


• Debian clamav-daemon_0.84-2.sarge.4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0. 84-2.sarge.4_sparc.deb


• Debian clamav-docs_0.84-2.sarge.4_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.84 -2.sarge.4_all.deb


• Debian clamav-freshclam_0.84-2.sarge.4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_amd64.deb


• Debian clamav-freshclam_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_arm.deb


• Debian clamav-freshclam_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_hppa.deb


• Debian clamav-freshclam_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_i386.deb


• Debian clamav-freshclam_0.84-2.sarge.4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_ia64.deb


• Debian clamav-freshclam_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_m68k.deb


• Debian clamav-freshclam_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_mips.deb


• Debian clamav-freshclam_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_mipsel.deb


• Debian clamav-freshclam_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_powerpc.deb


• Debian clamav-freshclam_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_s390.deb


• Debian clamav-freshclam_0.84-2.sarge.4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam _0.84-2.sarge.4_sparc.deb


• Debian clamav-milter_0.84-2.sarge.4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_alpha.deb


• Debian clamav-milter_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_arm.deb


• Debian clamav-milter_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_hppa.deb


• Debian clamav-milter_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_i386.deb


• Debian clamav-milter_0.84-2.sarge.4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_ia64.deb


• Debian clamav-milter_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_m68k.deb


• Debian clamav-milter_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_mips.deb


• Debian clamav-milter_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_mipsel.deb


• Debian clamav-milter_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_powerpc.deb


• Debian clamav-milter_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0. 84-2.sarge.4_s390.deb


• Debian clamav/libclamav1_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84- 2.sarge.4_i386.deb


• Debian clamav/libclamav1_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84- 2.sarge.4_mipsel.deb


• Debian clamav_0.84-2.sarge.4_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_alpha.deb


• Debian clamav_0.84-2.sarge.4_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_amd64.deb


• Debian clamav_0.84-2.sarge.4_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_arm.deb


• Debian clamav_0.84-2.sarge.4_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_hppa.deb


• Debian clamav_0.84-2.sarge.4_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_i386.deb


• Debian clamav_0.84-2.sarge.4_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_ia64.deb


• Debian clamav_0.84-2.sarge.4_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_m68k.deb


• Debian clamav_0.84-2.sarge.4_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_mips.deb


• Debian clamav_0.84-2.sarge.4_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_mipsel.deb


• Debian clamav_0.84-2.sarge.4_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_powerpc.deb


• Debian clamav_0.84-2.sarge.4_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_s390.deb


• Debian clamav_0.84-2.sarge.4_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sa rge.4_sparc.deb

Clam Anti-Virus ClamAV 0.84

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.84 rc1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.85

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.85.1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.86 .1

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.86

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638

Clam Anti-Virus ClamAV 0.86.2

• Clam Anti-Virus ClamAV 0.87
  http://sourceforge.net/project/showfiles.php?group_id=86638


• Trustix clamav-0.87-1tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix clamav-devel-0.87-1tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/

ClamAV FSG Compressed Executable Infinite Loop Denial Of Service Vulnerability

References:

• 0.87 Release Notes (ClamAV)
  
• Clam AV Win32-FSG File Handling DoS Vulnerability (iDEFENSE)
  
• Project Homepage (ClamAV)