Detections
Analytics
ClamAV < 0.99.2 Multiple libclamav DoS
medium Nessus Plugin ID 93897
Language:
Synopsis
The antivirus service running on the remote host is affected by multiple denial of service vulnerabilities.Description
According to its version, the ClamAV clamd antivirus daemon running on the remote host is prior to 0.99.2. It is, therefore, affected by multiple vulnerabilities :- A denial of service vulnerability exists in the libclamav library when handling specially crafted mew packer executables. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to crash the application.
(CVE-2016-1371)
- Multiple denial of service vulnerabilities exist in the libclamav library when handling specially crafted 7z files. An unauthenticated, remote attacker can exploit these, by convincing a user to open a specially crafted file, to crash the application. (CVE-2016-1372)
Solution
Upgrade to ClamAV version 0.99.2 or later.See Also
https://blog.clamav.net/2016/05/clamav-0992-has-been-released.html
https://foxglovesecurity.com/2016/06/13/finding-pearls-fuzzing-clamav/
Plugin Details
Severity: Medium
ID: 93897
File Name: clamav_0_99_2.nasl
Version: 1.6
Type: remote
Family: Misc.
Published: 10/6/2016
Updated: 11/15/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:clamav:clamav
Required KB Items: Settings/ParanoidReport, Antivirus/ClamAV/version
Exploit Ease: No known exploits are available
Patch Publication Date: 5/3/2016
Vulnerability Publication Date: 6/13/2016
Reference Information
CVE: CVE-2016-1371, CVE-2016-1372