ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
BID:28756
Info
ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
| Bugtraq ID: | 28756 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-1100 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 14 2008 12:00AM |
| Updated: | Apr 16 2015 06:07PM |
| Credit: | Alin Rad Pop, Secunia Research |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc Red Hat Fedora 7 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Kolab Kolab Groupware Server 2.1 Kolab Kolab Groupware Server 2.0.4 Kolab Kolab Groupware Server 2.0.3 Kolab Kolab Groupware Server 2.0.2 Kolab Kolab Groupware Server 2.0.1 Kolab Kolab Groupware Server 2.2-rc1 Kolab Kolab Groupware Server 2.2 beta3 Kolab Kolab Groupware Server 2.2 beta1 Kolab Kolab Groupware Server 2.2 -rc2 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Clam Anti-Virus ClamAV 0.92.1 Clam Anti-Virus ClamAV 0.92 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.5 |
| Not Vulnerable: |
Clam Anti-Virus ClamAV 0.93 Apple Mac OS X Server 10.5.5 |
Discussion
ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
ClamAV is prone to a heap-based buffer-overflow vulnerability because it fails to properly verify user-supplied data.
Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the vulnerable 'libclamav' library. Failed exploit attempts will likely cause denial-of-service conditions.
ClamAV 0.92 and 0.92.1 are vulnerable to this issue; other versions may also be affected.
ClamAV is prone to a heap-based buffer-overflow vulnerability because it fails to properly verify user-supplied data.
Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the vulnerable 'libclamav' library. Failed exploit attempts will likely cause denial-of-service conditions.
ClamAV 0.92 and 0.92.1 are vulnerable to this issue; other versions may also be affected.
Exploit / POC
ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
Solution:
Reports indicate that the vendor initially addressed this issue by remotely switching off the PE scanning module after 10/03/2008, but Symantec has not confirmed this. Please contact the vendor for information on final fixes and update procedures.
UPDATE: The vendor released ClamAV 0.93 to address this issue.
Apple Mac OS X Server 10.5
Apple Mac OS X Server 10.5.1
Apple Mac OS X Server 10.5.2
Apple Mac OS X Server 10.5.3
Apple Mac OS X Server 10.5.4
Solution:
Reports indicate that the vendor initially addressed this issue by remotely switching off the PE scanning module after 10/03/2008, but Symantec has not confirmed this. Please contact the vendor for information on final fixes and update procedures.
UPDATE: The vendor released ClamAV 0.93 to address this issue.
Apple Mac OS X Server 10.5
-
Apple MacOSXServerUpdCombo10.5.5.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.1
-
Apple MacOSXServerUpdCombo10.5.5.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.2
-
Apple MacOSXServerUpdCombo10.5.5.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.3
-
Apple MacOSXServerUpdCombo10.5.5.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.4
-
Apple MacOSXServerUpd10.5.5.dmg
http://www.apple.com/support/downloads/
References
ClamAV 'libclamav/pe.c' UPACK File Heap Based Buffer Overflow Vulnerability
References:
References:
- About the security content of Mac OS X v10.5.5 and Security Update 2008-006 (Apple)
- ClamAV Changelog (Clam Anti-Virus)
- ClamAV Homepage (Clam Anti-Virus)
- ClamAV Upack Processing Buffer Overflow Vulnerability (Secunia Research)
- Kolab Security Issue 20 20080416 (Kolab)