Clam AntiVirus (ClamAV) 0.88.6 allows remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

This update to ClamAV version 0.88.7 fixes various bugs :

  - Clam AntiVirus (ClamAV) allows remote attackers to cause     a denial of service (crash) via a malformed     base64-encoded MIME attachment that triggers a NULL     pointer dereference. (CVE-2006-5874)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to cause a denial of service (stack overflow and     application crash) by wrapping many layers of     multipart/mixed content around a document, a different     vulnerability than CVE-2006-5874 / CVE-2006-6406.
    (CVE-2006-6481)

  - Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers     to bypass virus detection by inserting invalid     characters into base64 encoded content in a     multipart/mixed MIME file, as demonstrated with the     EICAR test file. (CVE-2006-6406)

This update to ClamAV version 0.88.7 fixes various bugs :

CVE-2006-5874: Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a NULL pointer dereference.

CVE-2006-6481: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to cause a denial of service (stack overflow and application crash) by wrapping many layers of multipart/mixed content around a document, a different vulnerability than CVE-2006-5874 and CVE-2006-6406.

CVE-2006-6406: Clam AntiVirus (ClamAV) 0.88.6 allowed remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file.

The latest version of ClamAV, 0.88.7, fixes some bugs, including vulnerabilities with handling base64-encoded MIME attachment files that can lead to either a) a crash (CVE-2006-5874), or b) a bypass of virus detection (CVE-2006-6406).

As well, a vulnerability was discovered that allows remote attackers to cause a stack overflow and application crash by wrapping many layers of multipart/mixed content around a document (CVE-2006-6481).

The latest ClamAV is being provided to address these issues.

The remote host is affected by the vulnerability described in GLSA-200612-18 (ClamAV: Denial of Service)

    Hendrik Weimer discovered that ClamAV fails to properly handle deeply     nested MIME multipart/mixed content.
  Impact :

    By sending a specially crafted email with deeply nested MIME     multipart/mixed content an attacker could cause ClamAV to crash.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-6406     Hendrik Weimer discovered that invalid characters in     base64 encoded data may lead to bypass of scanning     mechanisms.

  - CVE-2006-6481     Hendrik Weimer discovered that deeply nested     multipart/mime MIME data may lead to denial of service.

Secunia reports :

Clam AntiVirus have a vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a stack overflow when scanning messages with deeply nested multipart content. This can be exploited to crash the service by sending specially crafted emails to a vulnerable system.

The remote host is running the ClamAV antivirus client version.
This version of ClamAV is vulnerable to a flaw where file scanning can be bypassed by passing malformed MIME-encoded requests.  An attacker exploiting this flaw would be able to send malicious files through the antivirus product without detection. 

ID	Name	Product	Family	Severity
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29397	SuSE 10 Security Update : clamav (ZYPP Patch Number 2390)	Nessus	SuSE Local Security Checks	medium
27177	openSUSE 10 Security Update : clamav (clamav-2391)	Nessus	SuSE Local Security Checks	medium
24613	Mandrake Linux Security Advisory : clamav (MDKSA-2006:230)	Nessus	Mandriva Local Security Checks	medium
23955	GLSA-200612-18 : ClamAV: Denial of Service	Nessus	Gentoo Local Security Checks	medium
23912	Debian DSA-1238-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	medium
23853	FreeBSD : clamav -- Multipart Nestings Denial of Service (eb5124a4-8a20-11db-b033-00123ffe8333)	Nessus	FreeBSD Local Security Checks	medium
3842	ClamAV < 0.88.7 MIME-encoded Scan Bypass (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2006-6481

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium