Detections
Analytics
ClamAV < 0.98.6 Multiple Vulnerabilities
high Nessus Plugin ID 81147
Language:
Synopsis
The antivirus service running on the remote host is affected by multiple vulnerabilities.Description
According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.6. It is, therefore, affected by the following vulnerabilities :- An out-of-bounds access flaw exists in the unupack() function that is triggered when parsing a specially crafted Upack packer file. A remote attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2014-9328)
- An out-of-bounds access flaw exists that is triggered when parsing maliciously crafted Yoda Crypter and MEW packer files. A remote attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-1461)
- An out-of-bounds access flaw exists that is triggered when parsing a specially crafted UPX packer file. A remote attacker can exploit this to crash the application, resulting in a denial of service condition.
(CVE-2015-1462)
- A signedness flaw exists in the petite_inflate2x_1to9() function in 'libclamav/petite.c' that allows a remote attacker with a specially crafted petite packer file to cause a denial of service. (CVE-2015-1463)
- An integer overflow condition exists in upx.c due to improper validation of user-supplied input when scanning EXE files. An attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code.
Solution
Upgrade to ClamAV 0.98.6 or later.See Also
https://blog.clamav.net/2015/01/clamav-0986-has-been-released.html
Plugin Details
Severity: High
ID: 81147
File Name: clamav_0_98_6.nasl
Version: 1.11
Type: remote
Family: Misc.
Published: 2/3/2015
Updated: 11/25/2019
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2015-1462
Vulnerability Information
CPE: cpe:/a:clamav:clamav
Required KB Items: Settings/ParanoidReport, Antivirus/ClamAV/version
Exploit Ease: No known exploits are available
Patch Publication Date: 1/27/2015
Vulnerability Publication Date: 1/27/2015
Reference Information
CVE: CVE-2014-9328, CVE-2015-1461, CVE-2015-1462, CVE-2015-1463