Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive.

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides clamav 0.95.2, which is not vulnerable to these issues. Additionally klamav-0.46 is being provided that has support for clamav-0.95+.

ClamAV update to version 0.95. This also fix some potential security bugs. (CVE-2009-1241)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

This update provides clamav 0.95.1, which is not vulnerable to these issues.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95.  Such versions fail to handle certain  malformed 'RAR' archive files, and hence it may be possible for certain archive files to evade detection from the scan engine. 

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95. Such versions are affected by multiple vulnerabilities :

  - A failure to handle certain malformed 'RAR' archive     files could make it possible for certain archive files     to     evade detection from the scan engine. (Bug 1467)

  - A failure to handle certain malformed 'RAR' archive     files could send the application into an infinite loop,     which could make it possible to crash the scan engine.
    (Bug 1462)

  - A divide by zero issue when handling specially crafted     'PE' file could be used to crash the affected     application. (Bug 1335)

ID	Name	Product	Family	Severity
43076	Mandriva Linux Security Advisory : clamav (MDVSA-2009:327)	Nessus	Mandriva Local Security Checks	critical
41486	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6144)	Nessus	SuSE Local Security Checks	high
41373	SuSE 11 Security Update : ClamAV (SAT Patch Number 749)	Nessus	SuSE Local Security Checks	high
41290	SuSE9 Security Update : ClamAV (YOU Patch Number 12388)	Nessus	SuSE Local Security Checks	high
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	critical
40199	openSUSE Security Update : clamav (clamav-750)	Nessus	SuSE Local Security Checks	high
39934	openSUSE Security Update : clamav (clamav-750)	Nessus	SuSE Local Security Checks	high
38165	Mandriva Linux Security Advisory : clamav (MDVSA-2009:097)	Nessus	Mandriva Local Security Checks	critical
36121	openSUSE 10 Security Update : clamav (clamav-6145)	Nessus	SuSE Local Security Checks	high
4982	ClamAV < 0.95 Scan Evasion (deprecated)	Nessus Network Monitor	Web Clients	high
36075	ClamAV < 0.95 Scan Evasion	Nessus	Misc.	medium

Detections

Analytics

CVE-2009-1241

critical

Tenable Plugins

critical

high

high

high

critical

high

high

critical

high

high

medium