ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer executable.

Versions of ClamAV prior to 0.99.2 are affected by multiple vulnerabilities :

 - Multiple flaws exists in 'libclamav' that are triggered during the handling of specially crafted 7z files. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1371)
 - A flaw exists in 'libclamav' that is triggered during the handling of a specially crafted mew packer executable. This may allow a context-dependent attacker to crash a process linked against the library. (CVE-2016-1372)

According to its version, the ClamAV clamd antivirus daemon running on the remote host is prior to 0.99.2. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the     libclamav library when handling specially crafted mew     packer executables. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to crash the application.
    (CVE-2016-1371)

  - Multiple denial of service vulnerabilities exist in the     libclamav library when handling specially crafted 7z     files. An unauthenticated, remote attacker can exploit     these, by convincing a user to open a specially crafted     file, to crash the application. (CVE-2016-1372)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3093-1 advisory.

    It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use     this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.

    In the default installation, attackers would be isolated by the ClamAV AppArmor profile.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
9793	ClamAV < 0.99.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	low
93897	ClamAV < 0.99.2 Multiple libclamav DoS	Nessus	Misc.	medium
93801	Ubuntu 14.04 LTS / 16.04 LTS : ClamAV vulnerabilities (USN-3093-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-1371

medium

Tenable Plugins

low

medium

high