The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are obtained from third party information.

Specially crafted CAB archives could crash clamav (CVE-2010-1311) or bypass virus detection (CVE-2010-0098). clamav has been updated to version 0.96 which fixes those issues.

Citing freshmeat.net :

This Release introduces new malware detection mechanisms and other significant improvements to the scan engine. Key features include the bytecode interpreter, heuristic improvements, signature improvements, support for new archives, support for new executable file formats, support for UPX 3.0, performance improvements and memory optimizations.

The remote host is affected by the vulnerability described in GLSA-201009-06 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Clam AntiVirus. For further     information, please consult the CVE entries referenced below.
  Impact :

    A remote attacker could possibly bypass virus detection or cause a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.6 or 10.5 that does not have Security Update 2010-005 applied. 

This security update contains fixes for the following products :

  - ATS
  - CFNetwork
  - ClamAV
  - CoreGraphics
  - libsecurity
  - PHP
  - Samba

Multiple vulnerabilities has been found and corrected in clamav :

ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities (CVE-2010-0098).

The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are obtained from third-party information (CVE-2010-1311).

This update provides clamav 0.96, which is not vulnerable to these issues.

Update :

Packages for 2009.0 are provided due to the Extended Maintenance Program.

It was discovered that ClamAV did not properly verify its input when processing CAB files. A remote attacker could send a specially crafted CAB file to evade malware detection. (CVE-2010-0098)

It was discovered that ClamAV did not properly verify its input when processing CAB files. A remote attacker could send a specially crafted CAB file and cause a denial of service via application crash.
(CVE-2010-1311).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

according to its version, the clamd anti-virus daemon on the remote host is earlier than 0.96.  Such versions are reportedly affected by multiple vulnerabilities : 

  - An attacker could bypass anti-virus detection by embedding malicious code in a specially crafted 'CAB' file. (1826)

  - An error in the 'qtm_decompress()' function in 'libclamav/mspack.c' could lead to memory corruption when scanning a specially crafted Quantum-compressed file. (1771)

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.96. Such versions are reportedly affected by multiple vulnerabilities :

  - An attacker could bypass antivirus detection by     embedding malicious code in a specially crafted 'CAB'     file. (1826)

  - An error in the 'qtm_decompress()' function in     'libclamav/mspack.c' could lead to memory corruption     when scanning a specially crafted Quantum-compressed     file. (1771)

ID	Name	Product	Family	Severity
50896	SuSE 11 Security Update : clamav (SAT Patch Number 2298)	Nessus	SuSE Local Security Checks	critical
49837	SuSE 10 Security Update : clamav (ZYPP Patch Number 6990)	Nessus	SuSE Local Security Checks	critical
49127	GLSA-201009-06 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
48424	Mac OS X Multiple Vulnerabilities (Security Update 2010-005)	Nessus	MacOS X Local Security Checks	high
46169	SuSE9 Security Update : clamav (YOU Patch Number 12610)	Nessus	SuSE Local Security Checks	critical
45622	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6983)	Nessus	SuSE Local Security Checks	critical
45567	Mandriva Linux Security Advisory : clamav (MDVSA-2010:082-1)	Nessus	Mandriva Local Security Checks	critical
45476	Ubuntu 8.10 / 9.04 / 9.10 : clamav vulnerabilities (USN-926-1)	Nessus	Ubuntu Local Security Checks	critical
5505	ClamAV < 0.96 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high
45437	ClamAV < 0.96 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2010-1311

medium

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

critical

high

medium