ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability

Bugtraq ID:	26946
Class:	Boundary Condition Error
CVE:	CVE-2007-6336
Remote:	Yes
Local:	No
Published:	Dec 19 2007 12:00AM
Updated:	Apr 13 2015 09:37PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SuSE Linux Desktop 10 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc SuSE Linux 10.0 x86-64 SuSE Linux 10.0 x86 SuSE Linux 10.0 ppc S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9.0 Redhat Fedora 7 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Kolab Kolab Groupware Server 2.1 Kolab Kolab Groupware Server 2.0.4 Kolab Kolab Groupware Server 2.0.3 Kolab Kolab Groupware Server 2.0.2 Kolab Kolab Groupware Server 2.0.1 Kolab Kolab Groupware Server 2.2 beta3 Kolab Kolab Groupware Server 2.2 beta1 Kolab Kolab Groupware Server 2.1beta2 Kolab Groupware Server 2.1.beta3 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Clam Anti-Virus ClamAV 0.91.2 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5
Not Vulnerable:	Clam Anti-Virus ClamAV 0.92

ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability

ClamAV is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.

Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the 'libclamav' library. Failed exploits may crash the application.

ClamAV 0.91.2 is vulnerable to this issue; other versions may also be affected.

ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability

Solution:
The vendor has released ClamAV 0.92 to address this issue. Please see the references for more information.


Clam Anti-Virus ClamAV 0.91.2

• Clam Anti-Virus ClamAV 0.92
  http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.92.tar.gz

Apple Mac OS X Server 10.5.2

• Apple SecUpdSrvr2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002.dmg

ClamAV 'mspack.c' Off-By-One Buffer Overflow Vulnerability

References:

• ClamAV Change Log (Clam AntiVirus)
  
• clamav changelog (Debian)
  
• ClamAV Homepage (Clam Anti-Virus)
  
• [SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff )
  
• Kolab Security Issue 18 20080109 (Kolab)