ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition."

The remote host is affected by the vulnerability described in GLSA-201512-08 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause ClamAV to scan a specially crafted file,       possibly resulting in a Denial of Service condition or other unspecified       impact.
  Workaround :

    There is no known workaround at this time.

Versions of ClamAV earlier than 0.98.6 are potentially affected by the following vulnerabilities : 

 - An out-of-bounds access flaw exists in the 'unupack()' function that is triggered when parsing a specially crafted Upack packer file. A remote attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2014-9328)
 - An out-of-bounds access flaw exists that is triggered when parsing maliciously crafted Yoda Crypter and MEWpacker files. A remote attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-1461)
 - An out-of-bounds access flaw exists that is triggered when parsing a specially crafted UPX packer file. A remote attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-1462)
 - A signedness flaw exists in the 'petite_inflate2x_1to9()' function in 'libclamav/petite.c' that allows a remote attacker with a specially crafted petite packer file to cause a denial of service. (CVE-2015-1463)
 - An integer overflow condition exists in 'upx.c' due to improper validation of user-supplied input when scanning EXE files. An attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code.

Upstream published version 0.98.7. This update updates sqeeze-lts to the latest upstream release in line with the approach used for other Debian releases.

The changes are not strictly required for operation, but users of the previous version in Squeeze may not be able to make use of all current virus signatures and might get warnings.

The bug fixes that are part of this release include security fixes related to packed or crypted files (CVE-2014-9328, CVE-2015-1461, CVE-2015-1462, CVE-2015-1463, CVE-2015-2170, CVE-2015-2221, CVE-2015-2222, and CVE-2015-2668) and several fixes to the embedded libmspack library, including a potential infinite loop in the Quantum decoder (CVE-2014-9556).

If you use clamav, we strongly recommend that you upgrade to this version.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

clamav was updated to version 0.98.6 to fix four security issues.

These security issues have been fixed :

  - ClamAV allowed remote attackers to have unspecified     impact via a crafted upx packer file, related to a heap     out of bounds condition. (bnc#916214). (CVE-2015-1462)

  - ClamAV allowed remote attackers to cause a denial of     service (crash) via a crafted petite packer file,     related to an incorrect compiler optimization.
    (bnc#916215). (CVE-2015-1463)

  - ClamAV allowed remote attackers to have unspecified     impact via a crafted upack packer file, related to a     heap out of bounds condition. (bnc#915512).
    (CVE-2014-9328)

  - ClamAV allowed remote attackers to have unspecified     impact via a crafted (1) Yoda's crypter or (2) mew     packer file, related to a heap out of bounds condition.
    (bnc#916217). (CVE-2015-1461)

clamav was updated to version 0.98.6 that fixes bugs and several security issues :

  - bsc#916217, CVE-2015-1461: Remote attackers can have     unspecified impact via Yoda's crypter or mew packer     files.

  - bsc#916214, CVE-2015-1462: Unspecified impact via     acrafted upx packer file.

  - bsc#916215, CVE-2015-1463: Remote attackers can cause a     denial of service via a crafted petite packer file.

  - bsc#915512, CVE-2014-9328: heap out of bounds condition     with crafted upack packer files.

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.6. It is, therefore, affected by the following vulnerabilities :

  - An out-of-bounds access flaw exists in the unupack()     function that is triggered when parsing a specially     crafted Upack packer file. A remote attacker can exploit     this to crash the application, resulting in a denial of     service condition. (CVE-2014-9328)

  - An out-of-bounds access flaw exists that is triggered     when parsing maliciously crafted Yoda Crypter and MEW     packer files. A remote attacker can exploit this to     crash the application, resulting in a denial of service     condition. (CVE-2015-1461)  
  - An out-of-bounds access flaw exists that is triggered     when parsing a specially crafted UPX packer file. A     remote attacker can exploit this to crash the     application, resulting in a denial of service condition.
    (CVE-2015-1462)

  - A signedness flaw exists in the petite_inflate2x_1to9()     function in 'libclamav/petite.c' that allows a remote     attacker with a specially crafted petite packer file     to cause a denial of service. (CVE-2015-1463)

  - An integer overflow condition exists in upx.c due to     improper validation of user-supplied input when scanning     EXE files. An attacker can exploit this to cause a     heap-based buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.

ClamAV 0.98.6 =============

ClamAV 0.98.6 is a bug fix release correcting the following :

  - library shared object revisions.

    - installation issues on some Mac OS X and FreeBSD       platforms.

    - includes a patch from Sebastian Andrzej Siewior making       ClamAV pid files compatible with systemd.

    - Fix a heap out of bounds condition with crafted Yoda's       crypter files. This issue was discovered by Felix       Groebert of the Google Security Team.

    - Fix a heap out of bounds condition with crafted mew       packer files. This issue was discovered by Felix       Groebert of the Google Security Team.

    - Fix a heap out of bounds condition with crafted upx       packer files. This issue was discovered by Kevin       Szkudlapski of Quarkslab.

    - Fix a heap out of bounds condition with crafted upack       packer files. This issue was discovered by Sebastian       Andrzej Siewior. CVE-2014-9328.

    - Compensate a crash due to incorrect compiler       optimization when handling crafted petite packer       files. This issue was discovered by Sebastian Andrzej       Siewior.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
87708	GLSA-201512-08 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
8826	ClamAV < 0.98.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
83888	Debian DLA-233-1 : clamav security and upstream version update	Nessus	Debian Local Security Checks	high
81389	SuSE 11.3 Security Update : clamav (SAT Patch Number 10283)	Nessus	SuSE Local Security Checks	high
81372	openSUSE Security Update : clamav (openSUSE-2015-147)	Nessus	SuSE Local Security Checks	high
81147	ClamAV < 0.98.6 Multiple Vulnerabilities	Nessus	Misc.	high
81115	Fedora 21 : clamav-0.98.6-1.fc21 (2015-1461)	Nessus	Fedora Local Security Checks	high
81114	Fedora 20 : clamav-0.98.6-1.fc20 (2015-1437)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2015-1462

high

Tenable Plugins

high

high

high

high

high

high

high

high