ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerability

Bugtraq ID:	26927
Class:	Boundary Condition Error
CVE:	CVE-2007-6335
Remote:	Yes
Local:	No
Published:	Dec 18 2007 12:00AM
Updated:	Apr 16 2015 06:13PM
Credit:	The researcher who discovered this issue wishes to remain anonymous.
Vulnerable:	SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SuSE openSUSE 10.3 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Desktop 10 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc Red Hat Fedora 7 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Kolab Kolab Groupware Server 2.1 Kolab Kolab Groupware Server 2.0.4 Kolab Kolab Groupware Server 2.0.3 Kolab Kolab Groupware Server 2.0.2 Kolab Kolab Groupware Server 2.0.1 Kolab Kolab Groupware Server 2.2 beta3 Kolab Kolab Groupware Server 2.2 beta1 Kolab Kolab Groupware Server 2.1beta2 Kolab Groupware Server 2.1.beta3 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Clam Anti-Virus ClamAV 0.91.2 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5
Not Vulnerable:	Clam Anti-Virus ClamAV 0.92

ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerability

ClamAV is prone to an integer-overflow vulnerability because it fails to properly verify user-supplied data.

Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the 'libclamav' library. Failed exploits may crash the application.

ClamAV 0.91.2 is vulnerable to this issue; other versions may also be affected.

ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/Thomas Pollet

ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerability

Solution:
The vendor has released ClamAV 0.92 to address this issue. Please see the references for more information.


Clam Anti-Virus ClamAV 0.91.2

• Clam Anti-Virus ClamAV 0.92
  http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.92.tar.gz

Apple Mac OS X Server 10.5.2

• Apple SecUpdSrvr2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002.dmg

ClamAV 'libclamav/pe.c' MEW Packed PE File Integer Overflow Vulnerability

References:

• ClamAV Change Log (Clam AntiVirus)
  
• clamav changelog (Debian)
  
• ClamAV Homepage (Clam Anti-Virus)
  
• ClamAV libclamav MEW PE File Integer Overflow Vulnerability (iDefense Labs)
  
• [SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff )
  
• iDefense Security Advisory 12.18.07: ClamAV libclamav MEW PE FileInteger Overf (iDefense Labs )
  
• Kolab Security Issue 18 20080109 (Kolab)