ClamAV update to version 0.95. This also fix some potential security bugs. (CVE-2009-1241)

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

This update provides clamav 0.95.1, which is not vulnerable to these issues.

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95. Such versions are affected by multiple vulnerabilities :

  - A failure to handle certain malformed 'RAR' archive     files could make it possible for certain archive files     to     evade detection from the scan engine. (Bug 1467)

  - A failure to handle certain malformed 'RAR' archive     files could send the application into an infinite loop,     which could make it possible to crash the scan engine.
    (Bug 1462)

  - A divide by zero issue when handling specially crafted     'PE' file could be used to crash the affected     application. (Bug 1335)

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides clamav 0.95.2, which is not vulnerable to these issues. Additionally klamav-0.46 is being provided that has support for clamav-0.95+.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95.  Such versions fail to handle certain  malformed 'RAR' archive files, and hence it may be possible for certain archive files to evade detection from the scan engine. 

ID	Name	Product	Family	Published	Updated	Severity
41486	SuSE 10 Security Update : ClamAV (ZYPP Patch Number 6144)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
41290	SuSE9 Security Update : ClamAV (YOU Patch Number 12388)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
38165	Mandriva Linux Security Advisory : clamav (MDVSA-2009:097)	Nessus	Mandriva Local Security Checks	4/27/2009	1/6/2021	critical
36075	ClamAV < 0.95 Scan Evasion	Nessus	Misc.	4/2/2009	11/15/2018	medium
36121	openSUSE 10 Security Update : clamav (clamav-6145)	Nessus	SuSE Local Security Checks	4/9/2009	1/14/2021	high
43076	Mandriva Linux Security Advisory : clamav (MDVSA-2009:327)	Nessus	Mandriva Local Security Checks	12/9/2009	1/6/2021	critical
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	9/11/2009	6/8/2022	critical
40199	openSUSE Security Update : clamav (clamav-750)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high
41373	SuSE 11 Security Update : ClamAV (SAT Patch Number 749)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
39934	openSUSE Security Update : clamav (clamav-750)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high
4982	ClamAV < 0.95 Scan Evasion (deprecated)	Nessus Network Monitor	Web Clients	4/3/2009	3/6/2019	high

Detections

Analytics

Plugins Search

high

high

critical

medium

high

critical

critical

high

high

high

high