ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	28798
Class:	Boundary Condition Error
CVE:	CVE-2008-1833
Remote:	Yes
Local:	No
Published:	Apr 15 2008 12:00AM
Updated:	Aug 25 2008 02:55PM
Credit:	Damian Put and Thomas Pollet
Vulnerable:	SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise SDK 10.SP1 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Linux Enterprise Server 9 S.u.S.E. Linux Enterprise Server 10.SP1 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc Red Hat Fedora 8 Red Hat Fedora 7 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Clam Anti-Virus ClamAV 0.92.1 Astaro Security Gateway 7.006 Astaro Security Gateway 7.005 Astaro Security Gateway 7
Not Vulnerable:	Clam Anti-Virus ClamAV 0.93

ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability

ClamAV is prone to a heap-based buffer-overflow vulnerability because it fails to properly verify user-supplied data.

Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the vulnerable 'libclamav' library. Failed exploit attempts will likely cause denial-of-service conditions.

ClamAV 0.92.1 is vulnerable to this issue; other versions may also be affected.

ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability

Solution:
The vendor addressed this issue in ClamAV 0.93. Contact the vendor for details on obtaining and applying the appropriate updates.


Clam Anti-Virus ClamAV 0.92.1

• Clam Anti-Virus clamav-0.93.tar.gz
  http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.93.tar.gz

ClamAV 'libclamav/pe.c' WWPACK File Heap Based Buffer Overflow Vulnerability

References:

• Bugzilla Bug 877 WWPack Heap Overflow Vulnerability (ClamAV)
  
• ClamAV Homepage (Clam Anti-Virus)
  
• ClamAV libclamav PE WWPack Heap Overflow Vulnerability (iDefense Labs)
  
• Up2Date ASG V7.300 GA Release (Astaro)