Clam Anti-Virus PE Rebuilding Heap Buffer Overflow Vulnerability

Bugtraq ID:	20535
Class:	Boundary Condition Error
CVE:	CVE-2006-4182
Remote:	Yes
Local:	No
Published:	Oct 16 2006 12:00AM
Updated:	Jan 17 2007 04:40PM
Credit:	iDefense is credited with the discovery of this issue.
Vulnerable:	Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Operating System Enterprise Server 2.0 SuSE Linux Enterprise Server 9 SuSE Linux Enterprise Server 10 + Linux kernel 2.6.5 S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Kolab Kolab Groupware Server 2.0.4 Kolab Kolab Groupware Server 2.0.3 Kolab Kolab Groupware Server 2.0.2 Kolab Kolab Groupware Server 2.0.1 Kolab Kolab Groupware Server 1.0.8 Kolab Kolab Groupware Server 1.0.7 Kolab Kolab Groupware Server 1.0.6 Kolab Kolab Groupware Server 1.0.5 Kolab Kolab Groupware Server 1.0.3 Kolab Kolab Groupware Server 1.0.1 Kolab Kolab Groupware Server 1.0 -20040426 Kolab Kolab Groupware Server 1.0 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 Kolab Kolab Groupware Server 2.1beta2 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Clam Anti-Virus ClamAV 0.88.4 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4
Not Vulnerable:	Clam Anti-Virus ClamAV 0.88.5

Clam Anti-Virus PE Rebuilding Heap Buffer Overflow Vulnerability

ClamAV is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Exploiting this issue could allow attacker-supplied machine code to execute in the context of the affected application. The issue would occur when the malformed file is scanned manually or automatically in deployments such as email gateways.

ClamAV version 0.88.4 is vulnerable to this issue.

Clam Anti-Virus PE Rebuilding Heap Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

The following proof of concept is available; Symantec has not tested its integrity:

• /data/vulnerabilities/exploits/clam_petite_heap.exe.bz2

Clam Anti-Virus PE Rebuilding Heap Buffer Overflow Vulnerability

Solution:
The vendor has released version 0.88.5 of ClamAV to address this issue.

Please see the referenced advisories for more information.


Clam Anti-Virus ClamAV 0.88.4

• Clam Anti-Virus Clam Antivirus 0.88.5
  http://sourceforge.net/project/shownotes.php?release_id=455799


• Mandriva clamav-0.88.5-0.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-0.1.20060mlcs4.src.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-0.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-0.1.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-0.1.C30mdk.src.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-0.1.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-1.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-1.1mdv2007.0.src.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-0.88.5-1.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-db-0.88.5-0.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-db-0.88.5-0.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-db-0.88.5-0.1.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-db-0.88.5-0.1.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-db-0.88.5-1.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-db-0.88.5-1.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-milter-0.88.5-0.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-milter-0.88.5-0.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-milter-0.88.5-0.1.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-milter-0.88.5-0.1.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-milter-0.88.5-1.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamav-milter-0.88.5-1.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamd-0.88.5-0.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamd-0.88.5-0.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva clamd-0.88.5-0.1.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamd-0.88.5-0.1.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva clamd-0.88.5-1.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva clamd-0.88.5-1.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva lib64clamav1-0.88.5-0.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva lib64clamav1-0.88.5-0.1.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva lib64clamav1-0.88.5-1.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva lib64clamav1-devel-0.88.5-0.1.20060mlcs4.x86_64.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva lib64clamav1-devel-0.88.5-0.1.C30mdk.x86_64.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva lib64clamav1-devel-0.88.5-1.1mdv2007.0.x86_64.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva libclamav1-0.88.5-0.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva libclamav1-0.88.5-0.1.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva libclamav1-0.88.5-1.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download


• Mandriva libclamav1-devel-0.88.5-0.1.20060mlcs4.i586.rpm
  Corporate 4.0:
  http://www.mandriva.com/en/download


• Mandriva libclamav1-devel-0.88.5-0.1.C30mdk.i586.rpm
  Corporate 3.0:
  http://www.mandriva.com/en/download


• Mandriva libclamav1-devel-0.88.5-1.1mdv2007.0.i586.rpm
  Mandriva Linux 2007.0:
  http://www.mandriva.com/en/download

Clam Anti-Virus PE Rebuilding Heap Buffer Overflow Vulnerability

References:

• Clam Antivirus release 0.88.5 (Clam Antivirus)
  
• ClamAV Homepage (Clam Anti-Virus)
  
• Vulnerability Note VU#180864 (US-CERT)
  
• iDefense Security Advisory 10.15.06: Clam AntiVirus ClamAV rebuildpe Heap Overfl (iDefense)
  
• Kolab Security Issue 13 20061019 (Kolab)