clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.

The remote host is affected by the vulnerability described in GLSA-201804-16 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, through multiple vectors, could execute arbitrary       code, cause a Denial of Service condition, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

This update for clamav fixes the following issues: Security issues fixed :

  - CVE-2012-6706: VMSF_DELTA filter inside the unrar     implementation allows an arbitrary memory write     (bsc#1045315).

  - CVE-2017-6419: A heap-based buffer overflow that can     lead to a denial of service in libmspack via a crafted     CHM file (bsc#1052449).

  - CVE-2017-11423: A stack-based buffer over-read that can     lead to a denial of service in mspack via a crafted CAB     file (bsc#1049423).

  - CVE-2018-1000085: An out-of-bounds heap read     vulnerability was found in XAR parser that can lead to a     denial of service (bsc#1082858).

  - CVE-2018-0202: Fixed two vulnerabilities in the PDF     parsing code (bsc#1083915).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav fixes the following issues :

Security issues fixed :

  - CVE-2012-6706: VMSF_DELTA filter inside the unrar     implementation allows an arbitrary memory write     (bsc#1045315).

  - CVE-2017-6419: A heap-based buffer overflow that can     lead to a denial of service in libmspack via a crafted     CHM file (bsc#1052449).

  - CVE-2017-11423: A stack-based buffer over-read that can     lead to a denial of service in mspack via a crafted CAB     file (bsc#1049423).

  - CVE-2018-1000085: An out-of-bounds heap read     vulnerability was found in XAR parser that can lead to a     denial of service (bsc#1082858).

  - CVE-2018-0202: Fixed two vulnerabilities in the PDF     parsing code (bsc#1083915).

This update was imported from the SUSE:SLE-12:Update update project.

Heap-based buffer overflow in mspack/lzxd.c

mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. (CVE-2017-6419)

Out-of-bounds access in the PDF parser (CVE-2018-0202)

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the 'DestPos' variable, which allows the attacker to write out of bounds when setting Mem[DestPos]. (CVE-2012-6706)

ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains..
This attack appear to be exploitable via The victim must scan a crafted XAR file. (CVE-2018-1000085)

Stack-based buffer over-read in cabd_read_string function

The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. (CVE-2017-11423)

Some vulnerabilities have been found in ClamAV, an open source antivirus engine :

CVE-2018-0202

It was found that ClamAV didn't process certain PDF files correctly, relating to a heap overflow. Specially crafted PDFs could yield ClamAV to crash, resulting in a denial of service or potentially execution of arbitrary code.

CVE-2018-1000085

Hanno B&ouml;ck discovered that ClamAV didn't process XAR files correctly. Malformed XAR files could cause ClamAV to crash by an out of bounds heap read. This could result in a denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 0.99.4+dfsg-1+deb7u1.

We recommend that you upgrade your clamav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 0.99.4

0.99.4 addresses a few outstanding vulnerability bugs. It includes fixes for :

  - CVE-2012-6706

  - CVE-2017-6419

  - CVE-2017-11423 

  - CVE-2018-1000085 

There are also a few bug fixes that were not assigned CVE&rsquo;s, but were important enough to address while we had the chance. One of these was the notorious file descriptor exhaustion bug that caused outages late last January.

In addition to the above, 0.99.4 fixes :

  - CVE-2018-0202: Two newly reported vulnerabilities in the     PDF parsing code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ClamAV incorrectly handled parsing certain PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-0202)

Hanno Bock discovered that ClamAV incorrectly handled parsing certain XAR files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2018-1000085).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
109230	GLSA-201804-16 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
108829	SUSE SLES11 Security Update : clamav (SUSE-SU-2018:0863-1)	Nessus	SuSE Local Security Checks	critical
108652	SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2018:0809-1)	Nessus	SuSE Local Security Checks	critical
108637	openSUSE Security Update : clamav (openSUSE-2018-314)	Nessus	SuSE Local Security Checks	critical
108601	Amazon Linux AMI : clamav (ALAS-2018-976)	Nessus	Amazon Linux Local Security Checks	critical
108415	Debian DLA-1307-1 : clamav security update	Nessus	Debian Local Security Checks	medium
108311	Fedora 26 : clamav (2018-d2b08aa37f)	Nessus	Fedora Local Security Checks	critical
107256	Ubuntu 14.04 LTS / 16.04 LTS : ClamAV vulnerabilities (USN-3592-1)	Nessus	Ubuntu Local Security Checks	medium
107169	Fedora 27 : clamav (2018-602b5345fa)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2018-0202

medium

Tenable Plugins

critical

critical

critical

critical

critical

medium

critical

medium

critical