The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides clamav 0.95.2, which is not vulnerable to these issues. Additionally klamav-0.46 is being provided that has support for clamav-0.95+.

This clamav version upgrade to 0.95.1 fixes a buffer overflow error in the cli_url_canon() function (CVE-2009-1372) and a denial of service condition occuring while parsing malformed UPack archives.
(CVE-2009-1371)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

The remote host is affected by the vulnerability described in GLSA-200909-04 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in ClamAV:
    The     vendor reported a Divide-by-zero error in the PE ('Portable     Executable'; Windows .exe) file handling of ClamAV     (CVE-2008-6680).
    Jeffrey Thomas Peckham found a flaw in     libclamav/untar.c, possibly resulting in an infinite loop when     processing TAR archives in clamd and clamscan (CVE-2009-1270).
    Martin Olsen reported a vulnerability in the CLI_ISCONTAINED macro     in libclamav/others.h, when processing UPack archives     (CVE-2009-1371).
    Nigel disclosed a stack-based buffer overflow     in the 'cli_url_canon()' function in libclamav/phishcheck.c when     processing URLs (CVE-2009-1372).
  Impact :

    A remote attacker could entice a user or automated system to process a     specially crafted UPack archive or a file containing a specially     crafted URL, possibly resulting in the remote execution of arbitrary     code with the privileges of the user running the application, or a     Denial of Service. Furthermore, a remote attacker could cause a Denial     of Service by supplying a specially crafted TAR archive or PE     executable to a Clam AntiVirus instance.
  Workaround :

    There is no known workaround at this time.

This clamav version upgrade to 0.95.1 fixes a buffer overflow error in the cli_url_canon() function (CVE-2009-1372) and a denial of service condition occuring while parsing malformed UPack archives (CVE-2009-1371).

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

This update provides clamav 0.95.1, which is not vulnerable to these issues.

It was discovered that ClamAV did not properly verify buffers when processing Upack files. A remote attacker could send a crafted file and cause a denial of service via application crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95.1.  Such versions are affected by multiple vulnerabilities : 

- ClamAV might crash while scanning certain malicious files packed with UPack. (Bug #1552)

- ClamAV might crash while using 'cli_url_canon'. (Bug #1553)

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95.1. Such versions are affected by multiple vulnerabilities :

  - ClamAV might crash while scanning certain malicious     files packed with UPack. (Bug #1552)

  - ClamAV might crash while using 'cli_url_canon'. (Bug     #1553)

ID	Name	Product	Family	Severity
43076	Mandriva Linux Security Advisory : clamav (MDVSA-2009:327)	Nessus	Mandriva Local Security Checks	critical
41295	SuSE9 Security Update : ClamAV (YOU Patch Number 12402)	Nessus	SuSE Local Security Checks	critical
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	critical
40912	GLSA-200909-04 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
40200	openSUSE Security Update : clamav (clamav-809)	Nessus	SuSE Local Security Checks	critical
39935	openSUSE Security Update : clamav (clamav-809)	Nessus	SuSE Local Security Checks	critical
38180	openSUSE 10 Security Update : clamav (clamav-6201)	Nessus	SuSE Local Security Checks	critical
38165	Mandriva Linux Security Advisory : clamav (MDVSA-2009:097)	Nessus	Mandriva Local Security Checks	critical
37389	Ubuntu 8.10 : clamav vulnerability (USN-756-1)	Nessus	Ubuntu Local Security Checks	medium
4986	ClamAV < 0.95.1 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	low
36131	ClamAV < 0.95.1 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2009-1371

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

medium

low

medium