ClamAV CAB/RAR/ZIP File Scan Evasion Vulnerability

BID:35426

Info

ClamAV CAB/RAR/ZIP File Scan Evasion Vulnerability

Bugtraq ID: 35426
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Jun 18 2009 12:00AM
Updated: Nov 18 2009 05:06PM
Credit: Thierry Zoller
Vulnerable: Pardus Linux 2009 0
Pardus Linux 2008 0
Kolab Kolab Groupware Server 2.2.2
Kolab Kolab Groupware Server 2.2
Kolab Kolab Groupware Server 2.1
Kolab Kolab Groupware Server 2.0.4
Kolab Kolab Groupware Server 2.0.3
Kolab Kolab Groupware Server 2.0.2
Kolab Kolab Groupware Server 2.0.1
Kolab Kolab Groupware Server 2.2-rc3
Kolab Kolab Groupware Server 2.2-rc1
Kolab Kolab Groupware Server 2.2 beta3
Kolab Kolab Groupware Server 2.2 beta1
Kolab Kolab Groupware Server 2.2 -rc2
Kolab Kolab Groupware Server 2.1beta2
ifenslave ifenslave 0.88
Clam Anti-Virus ClamAV 0.95.1
Clam Anti-Virus ClamAV 0.94.2
Clam Anti-Virus ClamAV 0.94.1
Clam Anti-Virus ClamAV 0.93.3
Clam Anti-Virus ClamAV 0.93.1
Clam Anti-Virus ClamAV 0.92.1
Clam Anti-Virus ClamAV 0.91.2
Clam Anti-Virus ClamAV 0.91.1
Clam Anti-Virus ClamAV 0.90.3
Clam Anti-Virus ClamAV 0.90.2
Clam Anti-Virus ClamAV 0.90.1
+ Debian Linux 4.0 sparc
 + Debian Linux 4.0 s/390
 + Debian Linux 4.0 powerpc
 + Debian Linux 4.0 mipsel
 + Debian Linux 4.0 mips
 + Debian Linux 4.0 m68k
 + Debian Linux 4.0 ia-64
 + Debian Linux 4.0 ia-32
 + Debian Linux 4.0 hppa
 + Debian Linux 4.0 arm
 + Debian Linux 4.0 amd64
 + Debian Linux 4.0 alpha
 + Debian Linux 4.0
 Clam Anti-Virus ClamAV 0.90
- MandrakeSoft Corporate Server 4.0 x86_64
 - MandrakeSoft Corporate Server 3.0 x86_64
 - MandrakeSoft Corporate Server 3.0
- MandrakeSoft Corporate Server 4.0
 - Mandriva Linux Mandrake 2007.1 x86_64
 - Mandriva Linux Mandrake 2007.1
 - Mandriva Linux Mandrake 2007.0 x86_64
 - Mandriva Linux Mandrake 2007.0
 Clam Anti-Virus ClamAV 0.88.5
Clam Anti-Virus ClamAV 0.88.4
Clam Anti-Virus ClamAV 0.88.3
Clam Anti-Virus ClamAV 0.88.2
Clam Anti-Virus ClamAV 0.88.1
Clam Anti-Virus ClamAV 0.87.1
Clam Anti-Virus ClamAV 0.87 -1
Clam Anti-Virus ClamAV 0.87
Clam Anti-Virus ClamAV 0.86.2
Clam Anti-Virus ClamAV 0.86 .1
Clam Anti-Virus ClamAV 0.86
Clam Anti-Virus ClamAV 0.85.1
Clam Anti-Virus ClamAV 0.85
Clam Anti-Virus ClamAV 0.84 rc2
Clam Anti-Virus ClamAV 0.84 rc1
Clam Anti-Virus ClamAV 0.84
+ Debian Linux 3.1 sparc
 + Debian Linux 3.1 s/390
 + Debian Linux 3.1 ppc
 + Debian Linux 3.1 mipsel
 + Debian Linux 3.1 mips
 + Debian Linux 3.1 m68k
 + Debian Linux 3.1 ia-64
 + Debian Linux 3.1 ia-32
 + Debian Linux 3.1 hppa
 + Debian Linux 3.1 arm
 + Debian Linux 3.1 alpha
 + Debian Linux 3.1
Clam Anti-Virus ClamAV 0.83
Clam Anti-Virus ClamAV 0.82
Clam Anti-Virus ClamAV 0.81
+ Gentoo Linux
Clam Anti-Virus ClamAV 0.80 rc4
Clam Anti-Virus ClamAV 0.80 rc3
Clam Anti-Virus ClamAV 0.80 rc2
Clam Anti-Virus ClamAV 0.80 rc1
Clam Anti-Virus ClamAV 0.80
Clam Anti-Virus ClamAV 0.75.1
Clam Anti-Virus ClamAV 0.70
Clam Anti-Virus ClamAV 0.68 -1
Clam Anti-Virus ClamAV 0.68
Clam Anti-Virus ClamAV 0.67
+ Gentoo Linux 1.4 _rc3
 + Gentoo Linux 1.4 _rc2
 + Gentoo Linux 1.4 _rc1
 + Gentoo Linux 1.4
Clam Anti-Virus ClamAV 0.65
Clam Anti-Virus ClamAV 0.60
Clam Anti-Virus ClamAV 0.54
Clam Anti-Virus ClamAV 0.53
Clam Anti-Virus ClamAV 0.52
Clam Anti-Virus ClamAV 0.51
Clam Anti-Virus ClamAV 0.95
Clam Anti-Virus ClamAV 0.94
Clam Anti-Virus ClamAV 0.93
Clam Anti-Virus ClamAV 0.92
Clam Anti-Virus ClamAV 0.91
Clam Anti-Virus ClamAV 0.88.6
Clam Anti-Virus ClamAV 0
Not Vulnerable: Clam Anti-Virus ClamAV 0.95.2

Discussion

ClamAV CAB/RAR/ZIP File Scan Evasion Vulnerability

ClamAV AntiVirus is prone to a vulnerability that may allow certain compressed archives to bypass the scan engine.

Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect.

Versions prior to ClamAV 0.95.2 are vulnerable.

Exploit / POC

ClamAV CAB/RAR/ZIP File Scan Evasion Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

ClamAV CAB/RAR/ZIP File Scan Evasion Vulnerability

Solution:
Updates are available. Please see the references for more information.


Clam Anti-Virus ClamAV 0.88.6

Clam Anti-Virus ClamAV 0.95

Clam Anti-Virus ClamAV 0.93

Clam Anti-Virus ClamAV 0.94

Clam Anti-Virus ClamAV 0.91

Clam Anti-Virus ClamAV 0

Clam Anti-Virus ClamAV 0.92

Clam Anti-Virus ClamAV 0.51

Clam Anti-Virus ClamAV 0.52

Clam Anti-Virus ClamAV 0.53

Clam Anti-Virus ClamAV 0.54

Clam Anti-Virus ClamAV 0.60

Clam Anti-Virus ClamAV 0.65

Clam Anti-Virus ClamAV 0.67

Clam Anti-Virus ClamAV 0.68

Clam Anti-Virus ClamAV 0.68 -1

Clam Anti-Virus ClamAV 0.70

Clam Anti-Virus ClamAV 0.75.1

Clam Anti-Virus ClamAV 0.80 rc4

Clam Anti-Virus ClamAV 0.80

Clam Anti-Virus ClamAV 0.80 rc3

Clam Anti-Virus ClamAV 0.80 rc1

Clam Anti-Virus ClamAV 0.80 rc2

Clam Anti-Virus ClamAV 0.81

Clam Anti-Virus ClamAV 0.82

Clam Anti-Virus ClamAV 0.83

Clam Anti-Virus ClamAV 0.84

Clam Anti-Virus ClamAV 0.84 rc2

Clam Anti-Virus ClamAV 0.84 rc1

Clam Anti-Virus ClamAV 0.85

Clam Anti-Virus ClamAV 0.85.1

Clam Anti-Virus ClamAV 0.86 .1

Clam Anti-Virus ClamAV 0.86

Clam Anti-Virus ClamAV 0.86.2

Clam Anti-Virus ClamAV 0.87

Clam Anti-Virus ClamAV 0.87 -1

Clam Anti-Virus ClamAV 0.87.1

ifenslave ifenslave 0.88

Clam Anti-Virus ClamAV 0.88.1

Clam Anti-Virus ClamAV 0.88.2

Clam Anti-Virus ClamAV 0.88.3

Clam Anti-Virus ClamAV 0.88.4

Clam Anti-Virus ClamAV 0.88.5

Clam Anti-Virus ClamAV 0.90

Clam Anti-Virus ClamAV 0.90.1

Clam Anti-Virus ClamAV 0.90.2

Clam Anti-Virus ClamAV 0.90.3

Clam Anti-Virus ClamAV 0.91.1

Clam Anti-Virus ClamAV 0.91.2

Clam Anti-Virus ClamAV 0.92.1

Clam Anti-Virus ClamAV 0.93.1

Clam Anti-Virus ClamAV 0.93.3

Clam Anti-Virus ClamAV 0.94.1

Clam Anti-Virus ClamAV 0.94.2

Clam Anti-Virus ClamAV 0.95.1

References

ClamAV CAB/RAR/ZIP File Scan Evasion Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report