Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1745     It was discovered that a file descriptor leak in the CHM     handler may lead to denial of service.

  - CVE-2007-1997     It was discovered that a buffer overflow in the CAB     handler may lead to the execution of arbitrary code.

  - CVE-2007-2029     It was discovered that a file descriptor leak in the PDF     handler may lead to denial of service.

The version update to 0.90.2 fixes among other things two security problems (CVE-2007-1745, CVE-2007-1997).

iDefense discovered a stack-based overflow in ClamAV when processing negative values in .cab files. As well, multiple file descriptor leaks were also reported and fixed in chmunpack.c, pdf.c, and dblock.c.

This update provides ClamAV 0.90.2 which corrects these problems and provides new functionality.

The version update to 0.90.2 fixes among other things two security problems. (CVE-2007-1745 / CVE-2007-1997)

The remote host is affected by the vulnerability described in GLSA-200704-21 (ClamAV: Multiple vulnerabilities)

    iDefense Labs have reported a stack-based buffer overflow in the     cab_unstore() function when processing negative values in .cab files.
    Multiple file descriptor leaks have also been reported in chmunpack.c,     pdf.c and dblock.c when processing .chm files.
  Impact :

    A remote attacker could send a specially crafted CHM file to the     scanner, possibly resulting in the remote execution of arbitrary code     with the privileges of the user running ClamAV.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host is running the ClamAV antivirus client.

This version of ClamAV is vulnerable to multiple attack vectors.  The more serious of the flaws is a buffer overflow.  An attacker exploiting this flaw would need to be able to manipulate ClamAV to scan a malicious file (via email, web, etc.).  Successful exploitation would result in the attacker executing arbitrary code on the remote ClamAV scanner.  

ID	Name	Product	Family	Published	Updated	Severity
25098	Debian DSA-1281-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	4/30/2007	1/4/2021	high
27180	openSUSE 10 Security Update : clamav (clamav-3080)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
25189	Mandrake Linux Security Advisory : clamav (MDKSA-2007:098)	Nessus	Mandriva Local Security Checks	5/10/2007	1/6/2021	high
29400	SuSE 10 Security Update : clamav (ZYPP Patch Number 3081)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	high
25109	GLSA-200704-21 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/30/2007	1/6/2021	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	3/19/2008	7/14/2018	critical
3966	ClamAV < 0.90.2 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	4/16/2007	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

medium