Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Updated clamav packages fix multiple vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:088 | First vendor Publication | 2008-04-17 |
| Vendor | Mandriva | Last vendor Modification | 2008-04-17 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.93 release, including: ClamAV 0.92 allowed local users to overwrite arbitrary files via a symlink attack on temporary files or on .ascii files in sigtool, when utf16-decode is enabled (CVE-2007-6595). A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary (CVE-2008-0314). An integer overflow in libclamav prior to 0.92.1 allowed remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggered a heap-based buffer overflow (CVE-2008-0318). An unspecified vulnerability in ClamAV prior to 0.92.1 triggered heap corruption (CVE-2008-0728). A buffer overflow in ClamAV 0.92 and 0.92.1 allowed remote attackers to execute arbitrary code via a crafted Upack PE file (CVE-2008-1100). ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (CPU consumption) via a crafted ARJ archive (CVE-2008-1387). A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted WWPack compressed PE binary (CVE-2008-1833). ClamAV prior to 0.93 allowed remote attackers to bypass the scanning engine via a RAR file with an invalid version number (CVE-2008-1835). A vulnerability in rfc2231 handling in ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (crash) via a crafted message that produced a string that was not null terminated, triggering a buffer over-read (CVE-2008-1836). A vulnerability in libclamunrar in ClamAV prior to 0.93 allowed remote attackers to cause a denial of service (crash) via a crafted RAR file (CVE-2008-1837). Other bugs have also been corrected in 0.93 which is being provided with this update. Because this new version has increased the major of the libclamav library, updated dependent packages are also being provided. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:088 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 38 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 25 % | CWE-399 | Resource Management Errors |
| 12 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
| 12 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
| 12 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18471 | |||
| Oval ID: | oval:org.mitre.oval:def:18471 | ||
| Title: | DSA-1497-1 clamav - several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in the Clam anti-virus toolkit, which may lead to the execution of arbitrary or local denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1497-1 CVE-2007-6595 CVE-2008-0318 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | clamav |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18708 | |||
| Oval ID: | oval:org.mitre.oval:def:18708 | ||
| Title: | DSA-1549-1 clamav | ||
| Description: | Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1549-1 CVE-2008-0314 CVE-2008-1100 CVE-2008-1833 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | clamav |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7444 | |||
| Oval ID: | oval:org.mitre.oval:def:7444 | ||
| Title: | DSA-1497 clamav -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in the Clam anti-virus toolkit, which may lead to the execution of arbitrary or local denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that temporary files are created insecurely, which may result in local denial of service by overwriting files. Silvio Cesare discovered an integer overflow in the parser for PE headers. The version of clamav in the old stable distribution (sarge) is no longer supported with security updates. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1497 CVE-2007-6595 CVE-2008-0318 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | clamav |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7781 | |||
| Oval ID: | oval:org.mitre.oval:def:7781 | ||
| Title: | DSA-1549 clamav -- buffer overflows | ||
| Description: | Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems: Damian Put discovered that a buffer overflow in the handler for PeSpin binaries may lead to the execution of arbitrary code. Alin Rad Pop discovered that a buffer overflow in the handler for Upack PE binaries may lead to the execution of arbitrary code. Damian Put and Thomas Pollet discovered that a buffer overflow in the handler for WWPack-compressed PE binaries may lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1549 CVE-2008-0314 CVE-2008-1100 CVE-2008-1833 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | clamav |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-05-12 | Name : Mac OS X 10.5.5 Update / Security Update 2008-006 File : nvt/macosx_upd_10_5_5_secupd_2008-006.nasl |
| 2009-10-10 | Name : SLES9: Security update for clamav File : nvt/sles9p5023300.nasl |
| 2009-10-10 | Name : SLES9: Security update for clamav File : nvt/sles9p5021938.nasl |
| 2009-04-09 | Name : Mandriva Update for clamav MDVSA-2008:088 (clamav) File : nvt/gb_mandriva_MDVSA_2008_088.nasl |
| 2009-02-17 | Name : Fedora Update for clamav FEDORA-2008-6422 File : nvt/gb_fedora_2008_6422_clamav_fc8.nasl |
| 2009-02-17 | Name : Fedora Update for clamav FEDORA-2008-9651 File : nvt/gb_fedora_2008_9651_clamav_fc8.nasl |
| 2009-02-17 | Name : Fedora Update for clamav FEDORA-2008-3900 File : nvt/gb_fedora_2008_3900_clamav_fc9.nasl |
| 2009-02-17 | Name : Fedora Update for clamav FEDORA-2008-3420 File : nvt/gb_fedora_2008_3420_clamav_fc8.nasl |
| 2009-02-17 | Name : Fedora Update for clamav FEDORA-2008-3358 File : nvt/gb_fedora_2008_3358_clamav_fc7.nasl |
| 2009-02-16 | Name : Fedora Update for clamav FEDORA-2008-1625 File : nvt/gb_fedora_2008_1625_clamav_fc8.nasl |
| 2009-02-16 | Name : Fedora Update for clamav FEDORA-2008-1608 File : nvt/gb_fedora_2008_1608_clamav_fc7.nasl |
| 2009-01-23 | Name : SuSE Update for clamav SUSE-SA:2008:024 File : nvt/gb_suse_2008_024.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200802-09 (clamav) File : nvt/glsa_200802_09.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200805-19 (clamav) File : nvt/glsa_200805_19.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200808-07 (clamav) File : nvt/glsa_200808_07.nasl |
| 2008-09-04 | Name : FreeBSD Ports: clamav File : nvt/freebsd_clamav14.nasl |
| 2008-09-04 | Name : FreeBSD Ports: clamav File : nvt/freebsd_clamav13.nasl |
| 2008-04-21 | Name : Debian Security Advisory DSA 1549-1 (clamav) File : nvt/deb_1549_1.nasl |
| 2008-02-29 | Name : ClamAV < 0.93.1 vulnerability File : nvt/clamav-CB-A08-0001.nasl |
| 2008-02-28 | Name : Debian Security Advisory DSA 1497-1 (clamav) File : nvt/deb_1497_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 44524 | ClamAV libclamunrar Crafted RAR File Handling Remote DoS |
| 44523 | ClamAV libclamav message.c rfc2231 Function Crafted Message Remote DoS |
| 44522 | ClamAV Crafted RAR File Handling Remote Security Bypass |
| 44521 | ClamAV libclamav Crafted WWPack Compressed PE File Remote Overflow |
| 44520 | ClamAV ARJ Archive Handling Unspecified Resource Consumption DoS |
| 44519 | ClamAV libclamav spin.c Crafted PeSpin Packed PE Binary Handling Overflow |
| 44370 | ClamAV libclamav/pe.c cli_scanpe Function Crafted Upack PE File Handling Remo... |
| 43338 | ClamAV sigtool .ascii Files Symlink Arbitrary File Overwrite |
| 43337 | ClamAV libclamav/others.c cli_gentempfd Function Symlink Arbitrary File Overw... |
| 42297 | ClamAV libclamav cli_scanpe Function Petite Packed PE File Handling Overflow |
| 42296 | ClamAV libclamav libclamav/mew.c unmew11 Function Unspecified Heap Corruption |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | ClamAV libclamav PE file handling integer overflow attempt RuleID : 17305 - Revision : 9 - Type : FILE-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-088.nasl - Type : ACT_GATHER_INFO |
| 2008-09-16 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-006.nasl - Type : ACT_GATHER_INFO |
| 2008-09-16 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_5.nasl - Type : ACT_GATHER_INFO |
| 2008-08-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200808-07.nasl - Type : ACT_GATHER_INFO |
| 2008-05-22 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200805-19.nasl - Type : ACT_GATHER_INFO |
| 2008-05-16 | Name : The remote Fedora host is missing a security update. File : fedora_2008-3900.nasl - Type : ACT_GATHER_INFO |
| 2008-05-01 | Name : The remote Fedora host is missing a security update. File : fedora_2008-3358.nasl - Type : ACT_GATHER_INFO |
| 2008-05-01 | Name : The remote Fedora host is missing a security update. File : fedora_2008-3420.nasl - Type : ACT_GATHER_INFO |
| 2008-04-25 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_clamav-5200.nasl - Type : ACT_GATHER_INFO |
| 2008-04-25 | Name : The remote openSUSE host is missing a security update. File : suse_clamav-5199.nasl - Type : ACT_GATHER_INFO |
| 2008-04-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1549.nasl - Type : ACT_GATHER_INFO |
| 2008-04-18 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_589d80530b0311ddb4ef00e07dc4ec84.nasl - Type : ACT_GATHER_INFO |
| 2008-03-19 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-002.nasl - Type : ACT_GATHER_INFO |
| 2008-02-25 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200802-09.nasl - Type : ACT_GATHER_INFO |
| 2008-02-18 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_be4b0529dbaf11dc9791000ea6702141.nasl - Type : ACT_GATHER_INFO |
| 2008-02-18 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_clamav-5008.nasl - Type : ACT_GATHER_INFO |
| 2008-02-18 | Name : The remote openSUSE host is missing a security update. File : suse_clamav-5009.nasl - Type : ACT_GATHER_INFO |
| 2008-02-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1497.nasl - Type : ACT_GATHER_INFO |
| 2008-02-14 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1625.nasl - Type : ACT_GATHER_INFO |
| 2008-02-14 | Name : The remote Fedora host is missing a security update. File : fedora_2008-1608.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:39:21 |
|
