Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference.

This update to ClamAV version 0.88.7 fixes various bugs :

  - Clam AntiVirus (ClamAV) allows remote attackers to cause     a denial of service (crash) via a malformed     base64-encoded MIME attachment that triggers a NULL     pointer dereference. (CVE-2006-5874)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to cause a denial of service (stack overflow and     application crash) by wrapping many layers of     multipart/mixed content around a document, a different     vulnerability than CVE-2006-5874 / CVE-2006-6406.
    (CVE-2006-6481)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to bypass virus detection by inserting invalid     characters into base64 encoded content in a     multipart/mixed MIME file, as demonstrated with the     EICAR test file. (CVE-2006-6406)

This update to ClamAV version 0.88.7 fixes various bugs :

CVE-2006-5874: Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a NULL pointer dereference.

CVE-2006-6481: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

CVE-2006-6406: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

The latest version of ClamAV, 0.88.7, fixes some bugs, including vulnerabilities with handling base64-encoded MIME attachment files that can lead to either a) a crash (CVE-2006-5874), or b) a bypass of virus detection (CVE-2006-6406).

As well, a vulnerability was discovered that allows remote attackers to cause a stack overflow and application crash by wrapping many layers of multipart/mixed content around a document (CVE-2006-6481).

The latest ClamAV is being provided to address these issues.

Stephen Gran discovered that malformed base64-encoded MIME attachments can lead to denial of service through a NULL pointer dereference.

The remote host is running the ClamAV antivirus client version.
This version of ClamAV is vulnerable to a flaw where file scanning can be bypassed by passing malformed MIME-encoded requests.  An attacker exploiting this flaw would be able to send malicious files through the antivirus product without detection. 

ID	Name	Product	Family	Severity
29397	SuSE 10 Security Update : clamav (ZYPP Patch Number 2390)	Nessus	SuSE Local Security Checks	medium
27177	openSUSE 10 Security Update : clamav (clamav-2391)	Nessus	SuSE Local Security Checks	medium
24613	Mandrake Linux Security Advisory : clamav (MDKSA-2006:230)	Nessus	Mandriva Local Security Checks	medium
23845	Debian DSA-1232-1 : clamav - missing sanity checks	Nessus	Debian Local Security Checks	medium
3842	ClamAV < 0.88.7 MIME-encoded Scan Bypass (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2006-5874

high

Tenable Plugins

medium

medium

medium

medium

medium