The bytecode engine in ClamAV before 0.97.3 allows remote attackers to cause a denial of service (crash) via vectors related to "recursion level" and (1) libclamav/bytecode.c and (2) libclamav/bytecode_api.c.

This version update of clamav fixes a recursion level crash.
CVE-2011-3627 was assigned to this issue.

Stephane Chazelas discovered the bytecode engine of ClamAV improperly handled recursion under certain circumstances. This could allow a remote attacker to craft a file that could cause ClamAV to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 0.97.3 which fixes CVE-2011-3627 clamav: Recursion level crash fixed in v0.97.3
----------------------------------------------------------------------
-----=

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201110-20 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Clam AntiVirus. Please       review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute arbitrary code with the       privileges of the Clam AntiVirus process or cause a Denial of Service by       causing an affected user or system to scan a crafted file.
  Workaround :

    There is no known workaround at this time.

Versions of ClamAV earlier than 0.97.3 are potentially affected by an unspecified denial of service vulnerability that can be exploited to cause the clamd daemon to crash.

ID	Name	Product	Family	Severity
75800	openSUSE Security Update : clamav (openSUSE-SU-2011:1177-1)	Nessus	SuSE Local Security Checks	medium
75452	openSUSE Security Update : clamav (openSUSE-SU-2011:1177-1)	Nessus	SuSE Local Security Checks	medium
57169	SuSE 10 Security Update : clamav (ZYPP Patch Number 7805)	Nessus	SuSE Local Security Checks	medium
57093	SuSE 11.1 Security Update : clamav (SAT Patch Number 5309)	Nessus	SuSE Local Security Checks	medium
56777	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : clamav vulnerability (USN-1258-1)	Nessus	Ubuntu Local Security Checks	medium
56733	Fedora 15 : clamav-0.97.3-1500.fc15 (2011-15119)	Nessus	Fedora Local Security Checks	medium
56732	Fedora 14 : clamav-0.97.3-1400.fc14 (2011-15076)	Nessus	Fedora Local Security Checks	medium
56731	Fedora 16 : clamav-0.97.3-1600.fc16 (2011-15033)	Nessus	Fedora Local Security Checks	medium
56602	SuSE 10 Security Update : clamav (ZYPP Patch Number 7804)	Nessus	SuSE Local Security Checks	medium
56595	GLSA-201110-20 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
6044	ClamAV < 0.97.3 DoS	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2011-3627

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium