Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerability

Bugtraq ID:	24316
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-2650
Remote:	Yes
Local:	No
Published:	Jun 04 2007 12:00AM
Updated:	Jun 25 2007 04:18PM
Credit:	Victor Stinner discovered this vulnerability.
Vulnerable:	Trustix Secure Linux 3.0.5 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 SuSE Linux Enterprise Server 9 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.1 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Clam Anti-Virus ClamAV 0.90.2 Clam Anti-Virus ClamAV 0.90.1 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0 Clam Anti-Virus ClamAV 0.90 - MandrakeSoft Corporate Server 4.0 x86_64 - MandrakeSoft Corporate Server 3.0 x86_64 - MandrakeSoft Corporate Server 3.0 - MandrakeSoft Corporate Server 4.0 - Mandriva Linux Mandrake 2007.1 x86_64 - Mandriva Linux Mandrake 2007.1 - Mandriva Linux Mandrake 2007.0 x86_64 - Mandriva Linux Mandrake 2007.0
Not Vulnerable:	Clam Anti-Virus ClamAV 0.90.3

Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerability

ClamAV is prone to a denial-of-service vulnerability when handling malformed OLE2 files.

A successful attack may allow an attacker to cause denial-of-service conditions.

Versions prior to ClamAV 0.90.3 are affected.

Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerability

Proof-of-concept code demonstrating this issue is reported to be publicly available.

Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerability

Solution:
The vendor released ClamAV 0.90.3 to address this issue. Please see the references for more information.


Clam Anti-Virus ClamAV 0.90

• Clam Anti-Virus clamav-0.90.3.tar.gz
  http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.90.3.tar.gz

Clam Anti-Virus ClamAV 0.90.1

• Clam Anti-Virus clamav-0.90.3.tar.gz
  http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.90.3.tar.gz

Clam Anti-Virus ClamAV 0.90.2

• Clam Anti-Virus clamav-0.90.3.tar.gz
  http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.90.3.tar.gz

Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerability

References:

• Bug in OLE2 file parser (Victor Stinner)
  
• ClamAV Homepage (Clam Anti-Virus)
  
• Clam AntiVirus Changelog (ClamAV)