ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file.

This update for p7zip fixes the following security issues :

  - CVE-2016-1372: Fixed multiple vulnerabilities when     processing crafted 7z files (bsc#984650)

  - CVE-2017-17969: Fixed a heap-based buffer overflow in a     shrink decoder (bsc#1077725)

  - CVE-2018-5996: Fixed memory corruption in RAR     decompression. The complete RAR decoder was removed as     it also has license issues (bsc#1077724 bsc#1077978)

This update was imported from the SUSE:SLE-12:Update update project.

This update for p7zip fixes the following issues: Security issues fixed :

  - CVE-2016-1372: Fixed multiple vulnerabilities when     processing crafted 7z files (bsc#984650)

  - CVE-2017-17969: Fixed a heap-based buffer overflow in a     shrink decoder (bsc#1077725)

  - CVE-2018-5996: Fixed memory corruption in RAR     decompression. The complete RAR decoder was removed as     it also has license issues (bsc#1077724 bsc#1077978)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of ClamAV prior to 0.99.2 are affected by multiple vulnerabilities :

 - Multiple flaws exists in 'libclamav' that are triggered during the handling of specially crafted 7z files. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1371)
 - A flaw exists in 'libclamav' that is triggered during the handling of a specially crafted mew packer executable. This may allow a context-dependent attacker to crash a process linked against the library. (CVE-2016-1372)

According to its version, the ClamAV clamd antivirus daemon running on the remote host is prior to 0.99.2. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the     libclamav library when handling specially crafted mew     packer executables. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to crash the application.
    (CVE-2016-1371)

  - Multiple denial of service vulnerabilities exist in the     libclamav library when handling specially crafted 7z     files. An unauthenticated, remote attacker can exploit     these, by convincing a user to open a specially crafted     file, to crash the application. (CVE-2016-1372)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3093-1 advisory.

    It was discovered that ClamAV incorrectly handled certain malformed files. A remote attacker could use     this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.

    In the default installation, attackers would be isolated by the ClamAV AppArmor profile.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
106920	openSUSE Security Update : p7zip (openSUSE-2018-188)	Nessus	SuSE Local Security Checks	high
106897	SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2018:0464-1)	Nessus	SuSE Local Security Checks	high
9793	ClamAV < 0.99.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	low
93897	ClamAV < 0.99.2 Multiple libclamav DoS	Nessus	Misc.	medium
93801	Ubuntu 14.04 LTS / 16.04 LTS : ClamAV vulnerabilities (USN-3093-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-1372

medium

Tenable Plugins

high

high

low

medium

high