According to its version, the clamd antivirus daemon on the remote host is earlier than 0.97. Such versions reportedly are affected by multiple vulnerabilities :

  - As-yet unspecified double-free issues involving an error     path exist in 'libclamav/vba_extract.c' and     'shared/cdiff.c'. (Bug 2486 and report from     <mt*debian.org>)

  - 'libclamav/pdf.c' may miss detection. (Bug 2455)

  - Multiple as-yet unspecified error path leaks exit in     'clamav-milter/whitelist.c', 'clamscan/manager.c', and     'libclamav/sis.c'. (Report from <mt*debian.org>)

It was discovered that the Microsoft Office processing code in libclamav improperly handled certain Visual Basic for Applications (VBA) data. This could allow a remote attacker to craft a document that could crash clamav or possibly execute arbitrary code.

In the default installation, attackers would be isolated by the ClamAV AppArmor profile.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 0.97

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted VBA data in Microsoft Office documents could crash clamav or potentially even cause execution of arbitrary code. clamav was updated to version 0.97 to fix the issue (CVE-2011-1003).

The remote host is affected by the vulnerability described in GLSA-201110-20 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Clam AntiVirus. Please       review the CVE identifiers referenced below for details.
  Impact :

    An unauthenticated remote attacker may execute arbitrary code with the       privileges of the Clam AntiVirus process or cause a Denial of Service by       causing an affected user or system to scan a crafted file.
  Workaround :

    There is no known workaround at this time.

Specially crafted VBA data in Microsoft Office documents could crash clamav or potentially even cause execution of arbitrary code. clamav was updated to version 0.97 to fix the issue. (CVE-2011-1003)

Versions of ClamAV earlier than 0.97 are potentially affected by multiple vulnerabilities : 

  -  As-yet unspecified double-free issue involving an error path exists in 'libclamav/vba_extract.c' and 'shared/cdiff.c'. (Bug 2486 and report from <mt*debian.org>)
,br.  - 'libclamav/pdf.c' may miss detection. (Bug 2455)

  - Multiple as-yet unspecified error path leaks exist in 'clamav-milter/whitelist.c', 'clamscan/manager.c' and 'libclamav/sis.c'. (Report from <mt*debian.org>)

ID	Name	Product	Family	Published	Updated	Severity
51935	ClamAV < 0.97 Multiple Vulnerabilities	Nessus	Misc.	2/10/2011	11/15/2018	high
52478	Ubuntu 9.10 / 10.04 LTS / 10.10 : clamav vulnerability (USN-1076-1)	Nessus	Ubuntu Local Security Checks	3/1/2011	9/19/2019	medium
52646	Fedora 13 : clamav-0.97-1300.fc13 (2011-2741)	Nessus	Fedora Local Security Checks	3/14/2011	1/11/2021	medium
53702	openSUSE Security Update : clamav (openSUSE-SU-2011:0208-1)	Nessus	SuSE Local Security Checks	5/5/2011	1/14/2021	medium
75450	openSUSE Security Update : clamav (openSUSE-SU-2011:0208-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium
56595	GLSA-201110-20 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/24/2011	1/6/2021	high
52591	Fedora 15 : clamav-0.97-1500.fc15 (2011-2732)	Nessus	Fedora Local Security Checks	3/9/2011	1/11/2021	medium
52647	Fedora 14 : clamav-0.97-1400.fc14 (2011-2743)	Nessus	Fedora Local Security Checks	3/14/2011	1/11/2021	medium
52765	SuSE 11.1 Security Update : clamav (SAT Patch Number 4155)	Nessus	SuSE Local Security Checks	3/23/2011	1/19/2021	medium
52989	SuSE 10 Security Update : clamav (ZYPP Patch Number 7380)	Nessus	SuSE Local Security Checks	3/27/2011	1/19/2021	medium
57167	SuSE 10 Security Update : clamav (ZYPP Patch Number 7397)	Nessus	SuSE Local Security Checks	12/13/2011	1/19/2021	medium
5796	ClamAV < 0.97 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2/15/2011	3/6/2019	high

Detections

Analytics

Plugins Search

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

high