ClamAV ARJ File Denial Of Service Vulnerability

Bugtraq ID:	28782
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-1387
Remote:	Yes
Local:	No
Published:	Apr 14 2008 12:00AM
Updated:	Apr 13 2015 09:58PM
Credit:	Oulu University Secure Programming Group (OUSPG), Hanno Boeck
Vulnerable:	SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 Redhat Fedora 7 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Kolab Kolab Groupware Server 2.1 Kolab Kolab Groupware Server 2.0.4 Kolab Kolab Groupware Server 2.0.3 Kolab Kolab Groupware Server 2.0.2 Kolab Kolab Groupware Server 2.0.1 Kolab Kolab Groupware Server 2.2-rc1 Kolab Kolab Groupware Server 2.2 beta3 Kolab Kolab Groupware Server 2.2 beta1 Kolab Kolab Groupware Server 2.2 -rc2 Clam Anti-Virus ClamAV 0.92.1 Clam Anti-Virus ClamAV 0.91.2 Clam Anti-Virus ClamAV 0.91.1 Clam Anti-Virus ClamAV 0.90.3 Clam Anti-Virus ClamAV 0.90.2 Clam Anti-Virus ClamAV 0.90.1 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0 Clam Anti-Virus ClamAV 0.90 - MandrakeSoft Corporate Server 4.0 x86_64 - MandrakeSoft Corporate Server 3.0 x86_64 - MandrakeSoft Corporate Server 3.0 - MandrakeSoft Corporate Server 4.0 - Mandriva Linux Mandrake 2007.1 x86_64 - Mandriva Linux Mandrake 2007.1 - Mandriva Linux Mandrake 2007.0 x86_64 - Mandriva Linux Mandrake 2007.0 Clam Anti-Virus ClamAV 0.92 Clam Anti-Virus ClamAV 0.91 Astaro Security Gateway 7.006 Astaro Security Gateway 7.005 Astaro Security Gateway 7
Not Vulnerable:	Clam Anti-Virus ClamAV 0.93

ClamAV ARJ File Denial Of Service Vulnerability

ClamAV is prone to a denial-of-service vulnerability because it fails to handle exceptional conditions.

Attackers can exploit this issue to cause denial-of-service conditions.

Versions prior to ClamAV 0.93 are vulnerable.

ClamAV ARJ File Denial Of Service Vulnerability

The file with the md5sum b6046d890e6bd304e3756c88b989559a from the PROTOS Genome Test Suite c10-archive triggers the issue.

ClamAV ARJ File Denial Of Service Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

ClamAV ARJ File Denial Of Service Vulnerability

References:

• ClamAV Homepage (Clam Anti-Virus)
  
• PROTOS Genome Test Suite c10-archive (Oulu University Secure Programming Group (OUSPG))
  
• clamav: Endless loop / hang with crafter arj, CVE-2008-1387 (Hanno Boeck)
  
• Kolab Security Issue 20 20080416 (Kolab)
  
• Up2Date ASG V7.300 GA Release (Astaro)