DSA-1771Executive Summary
| Summary | |
|---|---|
| Title | New clamav packages fix several vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | DSA-1771 | First vendor Publication | 2009-04-15 |
| Vendor | Debian | Last vendor Modification | 2009-04-15 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.8 | Attack Range | Network |
| Cvss Impact Score | 6.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentification | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
Several vulnerabilities have been discovered in the ClamAV anti-virus toolkit: CVE-2008-6680 Attackers can cayse a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error. CVE-2009-1270 Attackers can cause a denial of service (infinite loop) via a crafted tar file that causes (1) clamd and (2) clamscan to hang. (no CVE Id yet) Attackers can cause a denial of service (crash) via a crafted EXE file that crashes the UPack unpacker. For the old stable distribution (etch), these problems have been fixed in version 0.90.1dfsg-4etch19. For the stable distribution (lenny), these problems have been fixed in version 0.94.dfsg.2-1lenny2. For the unstable distribution (sid), these problems have been fixed in version 0.95.1+dfsg-1. We recommend that you upgrade your clamav packages. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1771 |
CWE : Common Weakness Enumeration
| id | Name |
|---|---|
| CWE-189 | Numeric Errors |
| CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 53602 | ClamAV Malformed UPack Packed File Handling DoS |
| 53598 | ClamAV --detect-broken Option PE File Handling DoS |
| 53461 | ClamAV libclamav/untar.c clamd / clamscan Infinite Loop DoS |
(High)
(Medium)
