Specially crafted CAB archives could crash clamav (CVE-2010-1311) or bypass virus detection (CVE-2010-0098). clamav has been updated to version 0.96 which fixes those issues.

Citing freshmeat.net :

This Release introduces new malware detection mechanisms and other significant improvements to the scan engine. Key features include the bytecode interpreter, heuristic improvements, signature improvements, support for new archives, support for new executable file formats, support for UPX 3.0, performance improvements and memory optimizations.

Multiple vulnerabilities has been found and corrected in clamav :

ClamAV before 0.96 does not properly handle the (1) CAB and (2) 7z file formats, which allows remote attackers to bypass virus detection via a crafted archive that is compatible with standard archive utilities (CVE-2010-0098).

The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are obtained from third-party information (CVE-2010-1311).

This update provides clamav 0.96, which is not vulnerable to these issues.

Update :

Packages for 2009.0 are provided due to the Extended Maintenance Program.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.96. Such versions are reportedly affected by multiple vulnerabilities :

  - An attacker could bypass antivirus detection by     embedding malicious code in a specially crafted 'CAB'     file. (1826)

  - An error in the 'qtm_decompress()' function in     'libclamav/mspack.c' could lead to memory corruption     when scanning a specially crafted Quantum-compressed     file. (1771)

The remote host is running a version of Mac OS X 10.6 or 10.5 that does not have Security Update 2010-005 applied. 

This security update contains fixes for the following products :

  - ATS
  - CFNetwork
  - ClamAV
  - CoreGraphics
  - libsecurity
  - PHP
  - Samba

It was discovered that ClamAV did not properly verify its input when processing CAB files. A remote attacker could send a specially crafted CAB file to evade malware detection. (CVE-2010-0098)

It was discovered that ClamAV did not properly verify its input when processing CAB files. A remote attacker could send a specially crafted CAB file and cause a denial of service via application crash.
(CVE-2010-1311).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201009-06 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Clam AntiVirus. For further     information, please consult the CVE entries referenced below.
  Impact :

    A remote attacker could possibly bypass virus detection or cause a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

according to its version, the clamd anti-virus daemon on the remote host is earlier than 0.96.  Such versions are reportedly affected by multiple vulnerabilities : 

  - An attacker could bypass anti-virus detection by embedding malicious code in a specially crafted 'CAB' file. (1826)

  - An error in the 'qtm_decompress()' function in 'libclamav/mspack.c' could lead to memory corruption when scanning a specially crafted Quantum-compressed file. (1771)

ID	Name	Product	Family	Published	Updated	Severity
49837	SuSE 10 Security Update : clamav (ZYPP Patch Number 6990)	Nessus	SuSE Local Security Checks	10/11/2010	1/14/2021	critical
46169	SuSE9 Security Update : clamav (YOU Patch Number 12610)	Nessus	SuSE Local Security Checks	4/28/2010	1/14/2021	critical
45567	Mandriva Linux Security Advisory : clamav (MDVSA-2010:082-1)	Nessus	Mandriva Local Security Checks	4/19/2010	1/6/2021	critical
45622	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6983)	Nessus	SuSE Local Security Checks	4/26/2010	1/14/2021	critical
45437	ClamAV < 0.96 Multiple Vulnerabilities	Nessus	Misc.	4/7/2010	11/15/2018	medium
48424	Mac OS X Multiple Vulnerabilities (Security Update 2010-005)	Nessus	MacOS X Local Security Checks	8/24/2010	7/14/2018	high
45476	Ubuntu 8.10 / 9.04 / 9.10 : clamav vulnerabilities (USN-926-1)	Nessus	Ubuntu Local Security Checks	4/9/2010	9/19/2019	critical
50896	SuSE 11 Security Update : clamav (SAT Patch Number 2298)	Nessus	SuSE Local Security Checks	12/2/2010	1/14/2021	critical
49127	GLSA-201009-06 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/8/2010	1/6/2021	critical
5505	ClamAV < 0.96 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	4/7/2010	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

medium

high

critical

critical

critical

high