ClamAV < 0.94.1 get_unicode_name() Off-by-One Buffer Overflow
High Nessus Plugin ID 34729
SynopsisThe remote antivirus service is affected by a buffer overflow vulnerability.
DescriptionAccording to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.1. Such versions have an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files, specifically in the 'get_unicode_name()' function of 'libclamav/vba_extract.c', when a specific 'name' buffer is passed to it.
Using a specially crafted VBA project file embedded in an OLE2 Office document, a remote attacker can trigger this vulnerability and execute arbitrary code on the remote host with the privileges of the 'clamd' process.
SolutionUpgrade to ClamAV 0.94.1 or later.