Executive Summary

Summary
Title ClamAV regression
Informations
Name USN-1482-3 First vendor Publication 2012-08-16
Vendor Ubuntu Last vendor Modification 2012-08-16
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04

Summary:

USN-1482-1 introduced a regression in ClamAV that could cause it to fail to scan certain documents.

Software Description: - clamav: Anti-virus utility for Unix

Details:

USN-1482-1 fixed vulnerabilities in ClamAV. The updated package could fail to properly scan files in some situations. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that ClamAV incorrectly handled certain malformed TAR
archives. A remote attacker could create a specially-crafted TAR file
containing malware that could escape being detected. (CVE-2012-1457,
CVE-2012-1459)

It was discovered that ClamAV incorrectly handled certain malformed CHM
files. A remote attacker could create a specially-crafted CHM file
containing malware that could escape being detected. (CVE-2012-1458)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
clamav 0.97.5+dfsg-1ubuntu0.12.04.3
libclamav6 0.97.5+dfsg-1ubuntu0.12.04.3

Ubuntu 11.10:
clamav 0.97.5+dfsg-1ubuntu0.11.10.3
libclamav6 0.97.5+dfsg-1ubuntu0.11.10.3

Ubuntu 11.04:
clamav 0.97.5+dfsg-1ubuntu0.11.04.3
libclamav6 0.97.5+dfsg-1ubuntu0.11.04.3

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1482-3
http://www.ubuntu.com/usn/usn-1482-1
https://launchpad.net/bugs/1015405

Package Information:
https://launchpad.net/ubuntu/+source/clamav/0.97.5+dfsg-1ubuntu0.12.04.3
https://launchpad.net/ubuntu/+source/clamav/0.97.5+dfsg-1ubuntu0.11.10.3
https://launchpad.net/ubuntu/+source/clamav/0.97.5+dfsg-1ubuntu0.11.04.3

Original Source

Url : http://www.ubuntu.com/usn/USN-1482-3

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17465
 
Oval ID: oval:org.mitre.oval:def:17465
Title: USN-1482-1 -- clamav vulnerabilities
Description: ClamAV could improperly detect malware if it opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1482-1
CVE-2012-1457
CVE-2012-1459
CVE-2012-1458
 Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.04
 Product(s): clamav
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17740
 
Oval ID: oval:org.mitre.oval:def:17740
Title: USN-1482-2 -- clamav regression
Description: ClamAV could improperly detect malware if it opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1482-2
CVE-2012-1457
CVE-2012-1459
CVE-2012-1458
 Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
 Product(s): clamav
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17990
 
Oval ID: oval:org.mitre.oval:def:17990
Title: USN-1482-3 -- clamav regression
Description: USN-1482-1 introduced a regression in ClamAV that could cause it to fail to scan certain documents.
Family: unix Class: patch
Reference(s): USN-1482-3
CVE-2012-1457
CVE-2012-1459
CVE-2012-1458
 Version: 7
Platform(s): Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04
 Product(s): clamav
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 2
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1
Application 1

OpenVAS Exploits

Date Description
2012-12-13 Name : SuSE Update for ClamAV openSUSE-SU-2012:0833-1 (ClamAV)
File : nvt/gb_suse_2012_0833_1.nasl
2012-08-30 Name : Fedora Update for clamav FEDORA-2012-9563
File : nvt/gb_fedora_2012_9563_clamav_fc17.nasl
2012-08-17 Name : Ubuntu Update for clamav USN-1482-3
File : nvt/gb_ubuntu_USN_1482_3.nasl
2012-08-10 Name : FreeBSD Ports: clamav
File : nvt/freebsd_clamav17.nasl
2012-07-16 Name : Fedora Update for clamav FEDORA-2012-9577
File : nvt/gb_fedora_2012_9577_clamav_fc16.nasl
2012-06-22 Name : Ubuntu Update for clamav USN-1482-1
File : nvt/gb_ubuntu_USN_1482_1.nasl
2012-06-22 Name : Ubuntu Update for clamav USN-1482-2
File : nvt/gb_ubuntu_USN_1482_2.nasl

Snort® IPS/IDS

Date Description
2014-06-14 possible TAR file oversize length field
RuleID : 30995 - Revision : 2 - Type : INDICATOR-COMPROMISE
2014-06-14 possible TAR file oversize length field
RuleID : 30994 - Revision : 2 - Type : INDICATOR-COMPROMISE
2014-01-16 CHM LZX compression reset interval anti-virus evasion attempt
RuleID : 28979 - Revision : 3 - Type : FILE-OTHER
2014-01-16 CHM LZX compression reset interval anti-virus evasion attempt
RuleID : 28978 - Revision : 3 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-362.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_clamav-120622.nasl - Type : ACT_GATHER_INFO
2012-08-17 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1482-3.nasl - Type : ACT_GATHER_INFO
2012-07-11 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9577.nasl - Type : ACT_GATHER_INFO
2012-07-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_clamav-8200.nasl - Type : ACT_GATHER_INFO
2012-06-27 Name : The remote antivirus service is affected by multiple vulnerabilities.
File : clamav_0_97_5.nasl - Type : ACT_GATHER_INFO
2012-06-25 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9563.nasl - Type : ACT_GATHER_INFO
2012-06-20 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1482-1.nasl - Type : ACT_GATHER_INFO
2012-06-20 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1482-2.nasl - Type : ACT_GATHER_INFO
2012-06-18 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_eb12ebeeb7af11e1b5e0000c299b62e1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:00:18
  • Multiple Updates