The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file, related to an inconsistency in the calculated stream length and the real stream length.

Update to 0.97

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues in clamav that can be used as a remote denial of service attack :

  - A off-by-one buffer overflow. (CVE-2010-1640)

  - A crash while parsing PDFs (CVE-2010-1639 /     CVE-2010-2077)

This update fixes the following security issues in clamav that can be used as a remote denial of service attack :

  - An off-by-one buffer overflow. (CVE-2010-1640)

  - A crash while parsing PDFs (CVE-2010-1639 /     CVE-2010-2077)

The remote host is affected by the vulnerability described in GLSA-201009-06 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Clam AntiVirus. For further     information, please consult the CVE entries referenced below.
  Impact :

    A remote attacker could possibly bypass virus detection or cause a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

Update to clamav 0.96.1 which fixes: CVE-2010-1639 Clam AntiVirus:
Heap-based overflow, when processing malicious PDF file(s)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a off-by-one buffer overflow (CVE-2010-1640) and a crash while parsing PDFs (CVE-2010-1639, CVE-2010-2077) in clamav that can be used as a remote denial of service attack.

This update fixes the following security issues in clamav that can be used as a remote denial of service attack :

  - An off-by-one buffer overflow. (CVE-2010-1640)

  - A crash while parsing PDFs. (CVE-2010-1639,     CVE-2010-2077)

It was discovered that ClamAV did not properly reallocate memory when processing certain PDF files. A remote attacker could send a specially crafted PDF and crash ClamAV. (CVE-2010-1639)

An out of bounds memory access flaw was discovered in ClamAV. A remote attacker could send a specially crafted Portable Executable (PE) file and crash ClamAV. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-2077).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities was discovered and fixed in clamav :

The cli_pdf function in libclamav/pdf.c in ClamAV before 0.96.1 allows remote attackers to cause a denial of service (crash) via a malformed PDF file, related to an inconsistency in the calculated stream length and the real stream length (CVE-2010-1639).

Off-by-one error in the parseicon function in libclamav/pe_icons.c in ClamAV 0.96 allows remote attackers to cause a denial of service (crash) via a crafted PE icon that triggers an out-of-bounds read, related to improper rounding during scaling (CVE-2010-1640).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update provides clamav 0.96.1 which is not vulnerable to these issues.

Versions of ClamAV earlier than 0.96.1 are potentially affected by multiple vulnerabilities :

  - An error exists within the 'cli_pdf()' function in 'libclamav/pdf.c' when processing certain PDF files. (2016)

  - An error exists within the 'parseicon()' function in 'libclamav/pe_icons.c' when processing PE icons.  This can be exploited to trigger an out-of-bounds access when reading data and potentially cause a crash via a specially crafted PE file. (2031)

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.96.1. Such versions are reportedly affected by multiple vulnerabilities :

  - An error exists within the 'cli_pdf()' function in     'libclamav/pdf.c' when processing certain PDF files.
    (Bug 2016)

  - An error exists within the 'parseicon()' function in     'libclamav/pe_icons.c' when processing PE icons.  This     can be exploited to trigger an out-of-bounds access when     reading data and potentially cause a crash via a     specially crafted PE file. (Bug 2031)

ID	Name	Product	Family	Severity
52647	Fedora 14 : clamav-0.97-1400.fc14 (2011-2743)	Nessus	Fedora Local Security Checks	medium
52646	Fedora 13 : clamav-0.97-1300.fc13 (2011-2741)	Nessus	Fedora Local Security Checks	medium
52591	Fedora 15 : clamav-0.97-1500.fc15 (2011-2732)	Nessus	Fedora Local Security Checks	medium
50897	SuSE 11 / 11.1 Security Update : clamav (SAT Patch Numbers 2479 / 2480)	Nessus	SuSE Local Security Checks	medium
49838	SuSE 10 Security Update : clamav (ZYPP Patch Number 7056)	Nessus	SuSE Local Security Checks	medium
49127	GLSA-201009-06 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
48366	Fedora 14 : clamav-0.96.1-1401.fc14 (2010-13012)	Nessus	Fedora Local Security Checks	medium
47798	openSUSE Security Update : clamav (openSUSE-SU-2010:0414-1)	Nessus	SuSE Local Security Checks	medium
47797	openSUSE Security Update : clamav (openSUSE-SU-2010:0414-1)	Nessus	SuSE Local Security Checks	medium
47796	openSUSE Security Update : clamav (openSUSE-SU-2010:0414-1)	Nessus	SuSE Local Security Checks	medium
47795	SuSE9 Security Update : clamav (YOU Patch Number 12619)	Nessus	SuSE Local Security Checks	medium
46752	Ubuntu 9.04 / 9.10 / 10.04 LTS : clamav vulnerabilities (USN-945-1)	Nessus	Ubuntu Local Security Checks	medium
46744	Mandriva Linux Security Advisory : clamav (MDVSA-2010:110)	Nessus	Mandriva Local Security Checks	medium
5548	ClamAV < 0.96.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
46706	ClamAV < 0.96.1 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2010-1639

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium