ClamAV 'petite.c' Invalid Memory Access Denial Of Service Vulnerability
BID:29750
Info
ClamAV 'petite.c' Invalid Memory Access Denial Of Service Vulnerability
| Bugtraq ID: | 29750 |
| Class: | Design Error |
| CVE: |
CVE-2008-2713 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 16 2008 12:00AM |
| Updated: | Apr 13 2015 09:45PM |
| Credit: | Damian Put |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server SDK 9 SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SP2 SuSE SUSE Linux Enterprise SDK 10 SP1 SuSE SUSE Linux Enterprise SDK 10 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SuSE Linux Desktop 1.0 SuSE Linux Desktop 10 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc SuSE Linux 10.0 x86-64 SuSE Linux 10.0 x86 SuSE Linux 10.0 ppc S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Novell Linux Desktop SDK 9.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.2 X86 64 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.2 X86 64 S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 Pardus Linux 2007 0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Kolab Kolab Groupware Server 2.1 Kolab Kolab Groupware Server 2.0.4 Kolab Kolab Groupware Server 2.0.3 Kolab Kolab Groupware Server 2.0.2 Kolab Kolab Groupware Server 2.0.1 Kolab Kolab Groupware Server 2.2-rc3 Kolab Kolab Groupware Server 2.2-rc1 Kolab Kolab Groupware Server 2.2 -rc2 Kolab Kolab Groupware Server 2.1beta2 ifenslave ifenslave 0.88 Gentoo Linux Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Clam Anti-Virus ClamAV 0.92.1 Clam Anti-Virus ClamAV 0.91.2 Clam Anti-Virus ClamAV 0.91.1 Clam Anti-Virus ClamAV 0.90.3 Clam Anti-Virus ClamAV 0.90.2 Clam Anti-Virus ClamAV 0.90.1 Clam Anti-Virus ClamAV 0.90 Clam Anti-Virus ClamAV 0.88.5 Clam Anti-Virus ClamAV 0.88.4 Clam Anti-Virus ClamAV 0.88.3 Clam Anti-Virus ClamAV 0.88.2 Clam Anti-Virus ClamAV 0.88.1 Clam Anti-Virus ClamAV 0.87.1 Clam Anti-Virus ClamAV 0.87 -1 Clam Anti-Virus ClamAV 0.87 Clam Anti-Virus ClamAV 0.86.2 Clam Anti-Virus ClamAV 0.86 .1 Clam Anti-Virus ClamAV 0.86 Clam Anti-Virus ClamAV 0.85.1 Clam Anti-Virus ClamAV 0.85 Clam Anti-Virus ClamAV 0.84 rc2 Clam Anti-Virus ClamAV 0.84 rc1 Clam Anti-Virus ClamAV 0.84 Clam Anti-Virus ClamAV 0.83 Clam Anti-Virus ClamAV 0.82 Clam Anti-Virus ClamAV 0.81 Clam Anti-Virus ClamAV 0.80 rc4 Clam Anti-Virus ClamAV 0.80 rc3 Clam Anti-Virus ClamAV 0.80 rc2 Clam Anti-Virus ClamAV 0.80 rc1 Clam Anti-Virus ClamAV 0.80 Clam Anti-Virus ClamAV 0.75.1 Clam Anti-Virus ClamAV 0.70 Clam Anti-Virus ClamAV 0.68 -1 Clam Anti-Virus ClamAV 0.68 Clam Anti-Virus ClamAV 0.67 Clam Anti-Virus ClamAV 0.65 Clam Anti-Virus ClamAV 0.60 Clam Anti-Virus ClamAV 0.54 Clam Anti-Virus ClamAV 0.53 Clam Anti-Virus ClamAV 0.52 Clam Anti-Virus ClamAV 0.51 Clam Anti-Virus ClamAV 0.93 Clam Anti-Virus ClamAV 0.92 Clam Anti-Virus ClamAV 0.91 Clam Anti-Virus ClamAV 0.88.6 Astaro Security Gateway 7.006 Astaro Security Gateway 7.005 Astaro Security Gateway 7 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.5 |
| Not Vulnerable: |
Clam Anti-Virus ClamAV 0.93.1 Apple Mac OS X Server 10.5.5 |
Discussion
ClamAV 'petite.c' Invalid Memory Access Denial Of Service Vulnerability
ClamAV is prone to a denial-of-service vulnerability caused by an invalid memory access during a 'memcpy()' call.
Attackers can exploit this issue to cause denial-of-service conditions. Given the nature of this issue, remote code execution may also be possible, but this has not been confirmed.
Versions prior to ClamAV 0.93.1 are vulnerable.
ClamAV is prone to a denial-of-service vulnerability caused by an invalid memory access during a 'memcpy()' call.
Attackers can exploit this issue to cause denial-of-service conditions. Given the nature of this issue, remote code execution may also be possible, but this has not been confirmed.
Versions prior to ClamAV 0.93.1 are vulnerable.
Exploit / POC
ClamAV 'petite.c' Invalid Memory Access Denial Of Service Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
ClamAV 'petite.c' Invalid Memory Access Denial Of Service Vulnerability
Solution:
Fixes are available. Please see the references for more information.
Apple Mac OS X Server 10.4.11
Apple Mac OS X Server 10.5.2
Apple Mac OS X Server 10.5.3
Solution:
Fixes are available. Please see the references for more information.
Apple Mac OS X Server 10.4.11
-
Apple SecUpdSrvr2008-006PPC.dmg
http://www.apple.com/support/downloads/ -
Apple SecUpdSrvr2008-006Univ.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.2
-
Apple MacOSXServerUpdCombo10.5.5.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.3
-
Apple MacOSXServerUpdCombo10.5.5.dmg
http://www.apple.com/support/downloads/
References
ClamAV 'petite.c' Invalid Memory Access Denial Of Service Vulnerability
References:
References:
- [/] [branches/] [0.93/] [libclamav/] [petite.c] - Diff between revs 3751 and 388 (Clam Anti-Virus)
- About the security content of Mac OS X v10.5.5 and Security Update 2008-006 (Apple)
- Bugzilla Bug 1000 Invalid memory access in petite (Clam Anti-Virus)
- ClamAV Homepage (Clam Anti-Virus)
- Kolab Security Issue 21 20080618 (Kolab)
- Up2Date ASG V7.300 GA Release (Astaro)