Buffer overflow in the find_stream_bounds function in pdf.c in libclamav in ClamAV before 0.96.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document. NOTE: some of these details are obtained from third party information.

clamav version 0.96.3 fixes problems when scanning pdf files (CVE-2010-3434) and also contains numerous other bug fixes.

The remote host is affected by the vulnerability described in GLSA-201110-20 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Clam AntiVirus. Please       review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute arbitrary code with the       privileges of the Clam AntiVirus process or cause a Denial of Service by       causing an affected user or system to scan a crafted file.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-001 applied. 

This security update contains fixes for the following products :

  - Apache
  - bzip2
  - ClamAV
  - ImageIO
  - Kerberos
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - Ruby
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

clamav was updated to version 0.96.4 which fixes problems when scanning pdf files (CVE-2010-3434) and also contains numerous other bug fixes.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.96.3. Such versions are reportedly affected by multiple vulnerabilities :

  - There is a failure to properly parse a specially crafted     PDF file because of insufficient bounds-checks on PDF     files in the 'find_stream_bounds()' function of the     libclamav 'pdf.c' source file. (Bug 2226)

  - An integer overflow can be triggered in the     'BZ2_decompress' function when parsing specially crafted     BZ2 files, which could cause the server to crash or     potentially allow execution of arbitrary code. (Bugs     2230, 2231)

Versions of ClamAV earlier than 0.96.3 are potentially affected by a denial-of-service vulnerability because the application fails to properly handle specially crafted PDF files.  An attacker, exploiting this flaw, can crash the affected service.

ID	Name	Product	Family	Severity
75448	openSUSE Security Update : clamav (openSUSE-SU-2010:0921-1)	Nessus	SuSE Local Security Checks	high
56595	GLSA-201110-20 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
52753	Mac OS X Multiple Vulnerabilities (Security Update 2011-001)	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
50898	SuSE 11 / 11.1 Security Update : clamav (SAT Patch Numbers 3440 / 3441)	Nessus	SuSE Local Security Checks	high
50856	SuSE 10 Security Update : clamav (ZYPP Patch Number 7209)	Nessus	SuSE Local Security Checks	high
50855	SuSE9 Security Update : clamav (YOU Patch Number 12662)	Nessus	SuSE Local Security Checks	high
50416	openSUSE Security Update : clamav (openSUSE-SU-2010:0921-1)	Nessus	SuSE Local Security Checks	high
50415	openSUSE Security Update : clamav (openSUSE-SU-2010:0921-1)	Nessus	SuSE Local Security Checks	high
49712	ClamAV < 0.96.3 Multiple Vulnerabilities	Nessus	Misc.	medium
5672	ClamAV < 0.96.3 DoS	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2010-3434

high

Tenable Plugins

high

high

high

high

high

critical

high

high

high

high

high

medium

medium