The tnef_attachment function in tnef.c for Clam AntiVirus (ClamAV) before 0.87.1 allows remote attackers to cause a denial of service (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block.

Several vulnerabilities have been discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3239     The OLE2 unpacker allows remote attackers to cause a     segmentation fault via a DOC file with an invalid     property tree, which triggers an infinite recursion.

  - CVE-2005-3303     A specially crafted executable compressed with FSG 1.33     could cause the extractor to write beyond buffer     boundaries, allowing an attacker to execute arbitrary     code.

  - CVE-2005-3500     A specially crafted CAB file could cause ClamAV to be     locked in an infinite loop and use all available     processor resources, resulting in a denial of service.

  - CVE-2005-3501     A specially crafted CAB file could cause ClamAV to be     locked in an infinite loop and use all available     processor resources, resulting in a denial of service.

A number of vulnerabilities were discovered in ClamAV versions prior to 0.87.1 :

The OLE2 unpacker in clamd allows remote attackers to cause a DoS (segfault) via a DOC file with an invalid property tree (CVE-2005-3239)

The FSG unpacker allows remote attackers to cause 'memory corruption' and execute arbitrary code via a crafted FSG 1.33 file (CVE-2005-3303)

The tnef_attachment() function allows remote attackers to cause a DoS (infinite loop and memory exhaustion) via a crafted value in a CAB file that causes ClamAV to repeatedly scan the same block (CVE-2005-3500)

Remote attackers could cause a DoS (infinite loop) via a crafted CAB file (CVE-2005-3501)

An improper bounds check in petite.c could allow attackers to perform unknown attacks via unknown vectors (CVE-2005-3587)

This update provides ClamAV 0.87.1 which corrects all of these issues.

The remote host is running ClamAV, an open-source antivirus solution for Unix-like systems.  This version of ClamAV is reported vulnerable to a flaw where the parsing of a malicious file will cause the clamav process to execute arbitrary code.  An attacker exploiting this flaw would only need to be able to craft and send a malformed email to a ClamAV server.  Successful exploitation results in the server executing arbitrary code or crashing. 

The remote host is affected by the vulnerability described in GLSA-200511-04 (ClamAV: Multiple vulnerabilities)

    ClamAV has multiple security flaws: a boundary check was performed     incorrectly in petite.c, a buffer size calculation in unfsg_133 was     incorrect in fsg.c, a possible infinite loop was fixed in tnef.c and a     possible infinite loop in cabd_find was fixed in cabd.c . In addition     to this, Marcin Owsiany reported that a corrupted DOC file causes a     segmentation fault in ClamAV.
  Impact :

    By sending a malicious attachment to a mail server that is hooked with     ClamAV, a remote attacker could cause a Denial of Service or the     execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
22753	Debian DSA-887-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	high
20439	Mandrake Linux Security Advisory : clamav (MDKSA-2005:205)	Nessus	Mandriva Local Security Checks	critical
3281	ClamAV < 0.87.1 Content-parsing Buffer Overflow (deprecated)	Nessus Network Monitor	Web Clients	low
20154	GLSA-200511-04 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2005-3500

medium

Tenable Plugins

high

critical

low

critical