Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted JPEG file, related to the cli_check_jpeg_exploit, jpeg_check_photoshop, and jpeg_check_photoshop_8bim functions.

Specially crafted jpg files could crash the clamd daemon of clamav.
(CVE-2008-5314)

Ilja van Sprundel discovered that ClamAV did not handle recursive JPEG information. If a remote attacker sent a specially crafted JPEG file, ClamAV would crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ilja van Sprundel found that ClamAV contained a denial of service vulnerability in how it handled processing JPEG files, due to it not limiting the recursion depth when processing JPEG thumbnails (CVE-2008-5314).

Other bugs have also been corrected in 0.94.2 which is being provided with this update.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

The remote host is affected by the vulnerability described in GLSA-200812-21 (ClamAV: Multiple vulnerabilities)

    Moritz Jodeit reported an off-by-one error within the     get_unicode_name() function in libclamav/vba_extract.c when processing     VBA project files (CVE-2008-5050). Ilja van Sprundel reported an     infinite recursion error within the cli_check_jpeg_exploit() function     in libclamav/special.c when processing JPEG files (CVE-2008-5314).
  Impact :

    A remote attacker could send a specially crafted VBA or JPEG file to     the clamd daemon, possibly resulting in the remote execution of     arbitrary code with the privileges of the user running the application     or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Moritz Jodeit discovered that ClamAV, an anti-virus solution, suffers from an off-by-one-error in its VBA project file processing, leading to a heap-based buffer overflow and potentially arbitrary code execution (CVE-2008-5050 ).

Ilja van Sprundel discovered that ClamAV contains a denial of service condition in its JPEG file processing because it does not limit the recursion depth when processing JPEG thumbnails (CVE-2008-5314 ).

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.2. There is a recursive stack overflow involving the JPEG parsing code in such versions. A remote attacker may be able to leverage this issue to cause the application to recursively scan a specially crafted JPEG, which will eventually cause it to crash.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.2.  There is a recursive stack overflow involving the JPEG parsing code in such versions.  A remote attacker may be able to leverage this issue to cause the application to recursively scan a specially crafted JPEG, which will eventually cause it to crash. 

ID	Name	Product	Family	Severity
41485	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 5842)	Nessus	SuSE Local Security Checks	medium
41262	SuSE9 Security Update : ClamAV (YOU Patch Number 12318)	Nessus	SuSE Local Security Checks	medium
39933	openSUSE Security Update : clamav (clamav-357)	Nessus	SuSE Local Security Checks	medium
37977	Ubuntu 8.10 : clamav vulnerability (USN-684-1)	Nessus	Ubuntu Local Security Checks	medium
37414	Mandriva Linux Security Advisory : clamav (MDVSA-2008:239)	Nessus	Mandriva Local Security Checks	medium
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
35268	GLSA-200812-21 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
35103	openSUSE 10 Security Update : clamav (clamav-5843)	Nessus	SuSE Local Security Checks	medium
35033	Debian DSA-1680-1 : clamav - buffer overflow, stack consumption	Nessus	Debian Local Security Checks	high
35009	ClamAV < 0.94.2 cli_check_jpeg_exploit() Malformed JPEG File DoS	Nessus	Gain a shell remotely	medium
4776	ClamAV < 0.94.2 cli_check_jpeg_exploit() Malformed JPEG File DoS (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2008-5314

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

high

medium

high

medium

medium