ClamAV 'clamav-milter' Initscript File Permission Vulnerability

Bugtraq ID:	34818
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 04 2009 12:00AM
Updated:	May 05 2009 01:56PM
Credit:	Unknown
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Clam Anti-Virus ClamAV 0.95.1
Not Vulnerable:

ClamAV 'clamav-milter' Initscript File Permission Vulnerability

ClamAV is prone to a file-permission security issue.

An attacker can exploit this issue to modify files in certain directories, which could affect system integrity and lead to other attacks.

ClamAV 0.95.1 is vulnerable; other versions may also be affected.

ClamAV 'clamav-milter' Initscript File Permission Vulnerability

Attackers can use readily available tools and standard commands to exploit this issue.

ClamAV 'clamav-milter' Initscript File Permission Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu clamav-dbg_0.95.1+dfsg-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.95.1 +dfsg-1ubuntu1.2_amd64.deb


• Ubuntu clamav-docs_0.95.1+dfsg-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.95. 1+dfsg-1ubuntu1.2_all.deb


• Ubuntu clamav-freshclam_0.95.1+dfsg-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_ 0.95.1+dfsg-1ubuntu1.2_amd64.deb


• Ubuntu clamav-milter_0.95.1+dfsg-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter _0.95.1+dfsg-1ubuntu1.2_amd64.deb


• Ubuntu clamav_0.95.1+dfsg-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.95.1+dfs g-1ubuntu1.2_amd64.deb


• Ubuntu libclamav-dev_0.95.1+dfsg-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.9 5.1+dfsg-1ubuntu1.2_amd64.deb


• Ubuntu libclamav6_0.95.1+dfsg-1ubuntu1.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav6_0.95.1 +dfsg-1ubuntu1.2_amd64.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu clamav-dbg_0.95.1+dfsg-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.95.1+dfsg-1ubu ntu1.2_lpia.deb


• Ubuntu clamav-docs_0.95.1+dfsg-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.95. 1+dfsg-1ubuntu1.2_all.deb


• Ubuntu clamav-freshclam_0.95.1+dfsg-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.95.1+dfs g-1ubuntu1.2_lpia.deb


• Ubuntu clamav-milter_0.95.1+dfsg-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.95.1+df sg-1ubuntu1.2_lpia.deb


• Ubuntu clamav_0.95.1+dfsg-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.95.1+dfsg-1ubuntu1 .2_lpia.deb


• Ubuntu libclamav-dev_0.95.1+dfsg-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.95.1+dfsg-1 ubuntu1.2_lpia.deb


• Ubuntu libclamav6_0.95.1+dfsg-1ubuntu1.2_lpia.deb
  http://ports.ubuntu.com/pool/main/c/clamav/libclamav6_0.95.1+dfsg-1ubu ntu1.2_lpia.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu clamav-dbg_0.95.1+dfsg-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.95.1+dfsg-1ubu ntu1.2_sparc.deb


• Ubuntu clamav-docs_0.95.1+dfsg-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.95. 1+dfsg-1ubuntu1.2_all.deb


• Ubuntu clamav-freshclam_0.95.1+dfsg-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.95.1+dfs g-1ubuntu1.2_sparc.deb


• Ubuntu clamav-milter_0.95.1+dfsg-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.95.1+df sg-1ubuntu1.2_sparc.deb


• Ubuntu clamav_0.95.1+dfsg-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.95.1+dfsg-1ubuntu1 .2_sparc.deb


• Ubuntu libclamav-dev_0.95.1+dfsg-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.95.1+dfsg-1 ubuntu1.2_sparc.deb


• Ubuntu libclamav6_0.95.1+dfsg-1ubuntu1.2_sparc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/libclamav6_0.95.1+dfsg-1ubu ntu1.2_sparc.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu clamav-dbg_0.95.1+dfsg-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.95.1+dfsg-1ubu ntu1.2_powerpc.deb


• Ubuntu clamav-docs_0.95.1+dfsg-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.95. 1+dfsg-1ubuntu1.2_all.deb


• Ubuntu clamav-freshclam_0.95.1+dfsg-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.95.1+dfs g-1ubuntu1.2_powerpc.deb


• Ubuntu clamav-milter_0.95.1+dfsg-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.95.1+df sg-1ubuntu1.2_powerpc.deb


• Ubuntu clamav_0.95.1+dfsg-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.95.1+dfsg-1ubuntu1 .2_powerpc.deb


• Ubuntu libclamav-dev_0.95.1+dfsg-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.95.1+dfsg-1 ubuntu1.2_powerpc.deb


• Ubuntu libclamav6_0.95.1+dfsg-1ubuntu1.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/clamav/libclamav6_0.95.1+dfsg-1ubu ntu1.2_powerpc.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu clamav-dbg_0.95.1+dfsg-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.95.1 +dfsg-1ubuntu1.2_i386.deb


• Ubuntu clamav-docs_0.95.1+dfsg-1ubuntu1.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.95. 1+dfsg-1ubuntu1.2_all.deb


• Ubuntu clamav-freshclam_0.95.1+dfsg-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_ 0.95.1+dfsg-1ubuntu1.2_i386.deb


• Ubuntu clamav-milter_0.95.1+dfsg-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter _0.95.1+dfsg-1ubuntu1.2_i386.deb


• Ubuntu clamav_0.95.1+dfsg-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.95.1+dfs g-1ubuntu1.2_i386.deb


• Ubuntu libclamav-dev_0.95.1+dfsg-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.9 5.1+dfsg-1ubuntu1.2_i386.deb


• Ubuntu libclamav6_0.95.1+dfsg-1ubuntu1.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav6_0.95.1 +dfsg-1ubuntu1.2_i386.deb

ClamAV 'clamav-milter' Initscript File Permission Vulnerability

References:

• ClamAV Homepage (Clam Anti-Virus)