CVE-2007-3024

low
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.

References

http://kolab.org/security/kolab-vendor-notice-15.txt

http://lurker.clamav.net/message/20070530.224918.5c64abc4.en.html

http://secunia.com/advisories/25523

http://secunia.com/advisories/25525

http://secunia.com/advisories/25688

http://secunia.com/advisories/25796

http://security.gentoo.org/glsa/glsa-200706-05.xml

http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog

http://www.debian.org/security/2007/dsa-1320

http://www.novell.com/linux/security/advisories/2007_33_clamav.html

http://www.securityfocus.com/bid/24358

https://wwws.clamav.net/bugzilla/show_bug.cgi?id=517

Details

Source: MITRE

Published: 2007-06-07

Updated: 2008-09-05

Risk Information

CVSS v2

Base Score: 2.1

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 3.9

Severity: LOW

Tenable Plugins

View all (5 total)

IDNameProductFamilySeverity
25586Debian DSA-1320-1 : clamav - several vulnerabilitiesNessusDebian Local Security Checks
critical
25560FreeBSD : clamav -- multiple vulnerabilities (903654bd-1927-11dc-b8a0-02e0185f8d72)NessusFreeBSD Local Security Checks
critical
25534GLSA-200706-05 : ClamAV: Multiple Denials of ServiceNessusGentoo Local Security Checks
critical
25432Mandrake Linux Security Advisory : clamav (MDKSA-2007:115)NessusMandriva Local Security Checks
critical
4075ClamAV < 0.90.3 Multiple Vulnerabilities (deprecated)Nessus Network MonitorWeb Clients
medium