Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.

New clamav packages fix an off-by-one vulnerability which could lead to a DoS condition. CVE-2011-2721 has been assigned to this issue.

Update to 0.97.3 which fixes CVE-2011-3627 clamav: Recursion level crash fixed in v0.97.3
----------------------------------------------------------------------
-----=

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201110-20 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Clam AntiVirus. Please       review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute arbitrary code with the       privileges of the Clam AntiVirus process or cause a Denial of Service by       causing an affected user or system to scan a crafted file.
  Workaround :

    There is no known workaround at this time.

New clamav 0.9.7 packages fix an off-by-one vulnerability which could lead to a DoS condition. (CVE-2011-2721)

It also brings other enhancements, support for signatures based on SHA1 and SHA256, better error detection, as well as speed and memory optimizations. The complete list of changes is available in the ChangeLog file. For upgrade notes and tips please see :

https://wiki.clamav.net/Main/UpgradeNotes097

According to its version, the ClamAV clamd antivirus daemon on the remote host is earlier than 0.97.2. As such, it is potentially affected by a denial of service vulnerability.

An off-by-one error exists in the 'cli_hm_scan' function in the file 'libclamav/matcher-hash.c' that can be exploited by a specially crafted message causing the clamd daemon to crash.

.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in clamav :

Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations (CVE-2011-2721).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the 0.97.2 version which is not vulnerable to this issue.

It was discovered that the hash processing code in libclamav improperly handled messages with certain hashes. This could allow a remote attacker to craft a document that could cause clamav to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75799	openSUSE Security Update : clamav (openSUSE-SU-2011:0940-1)	Nessus	SuSE Local Security Checks	medium
75451	openSUSE Security Update : clamav (openSUSE-SU-2011:0940-1)	Nessus	SuSE Local Security Checks	medium
57168	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 7662)	Nessus	SuSE Local Security Checks	medium
56733	Fedora 15 : clamav-0.97.3-1500.fc15 (2011-15119)	Nessus	Fedora Local Security Checks	medium
56732	Fedora 14 : clamav-0.97.3-1400.fc14 (2011-15076)	Nessus	Fedora Local Security Checks	medium
56731	Fedora 16 : clamav-0.97.3-1600.fc16 (2011-15033)	Nessus	Fedora Local Security Checks	medium
56595	GLSA-201110-20 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
55974	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 7661)	Nessus	SuSE Local Security Checks	medium
55972	SuSE 11.1 Security Update : ClamAV (SAT Patch Number 4942)	Nessus	SuSE Local Security Checks	medium
55971	SuSE9 Security Update : clamav (YOU Patch Number 12821)	Nessus	SuSE Local Security Checks	medium
55905	ClamAV < 0.97.2 'cli_hm_scan' Denial of Service	Nessus	Misc.	medium
55866	Fedora 15 : clamav-0.97.2-1500.fc15 (2011-10090)	Nessus	Fedora Local Security Checks	medium
55865	Fedora 14 : clamav-0.97.2-1400.fc14 (2011-10053)	Nessus	Fedora Local Security Checks	medium
55848	Mandriva Linux Security Advisory : clamav (MDVSA-2011:122)	Nessus	Mandriva Local Security Checks	medium
55729	Ubuntu 11.04 : clamav vulnerability (USN-1179-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-2721

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium