Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

ClamAV < 0.94.1 get_unicode_name() Function Off-by-One Buffer Overflow (deprecated)

High

Synopsis

The remote antivirus service is affected by a buffer overflow vulnerability.

Description

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.94.1. Such versions have an off-by-one heap overflow vulnerability in the code responsible for parsing VBA project files, specifically in the 'get_unicode_name()' function of 'libclamav/vba_extract.c', when a specific 'name' buffer is passed to it. Using a specially crafted VBA project file embedded in an OLE2 Office document, a remote attacker can trigger this vulnerability and execute arbitrary code on the remote host with the privileges of the 'clamd' process.

Solution

Upgrade to version 0.94.1 or later.