A remote overflow exists in Clam AntiVirus. Clam AntiVirus fails to perform adequate boundary check in libclamav/fsg.c, resulting in a heap overflow. With a specially crafted request, an attacker can gain privileges equal to those of the Clam AntiVirus process, possibly allowing for a remote system compromise.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
Technical
FSG processing contains a faulty boundary check that results in a buffer overflow. The following is vulnerable code from unfsg() in fsg.c. Specifically, backbytes and backsize are essentially encoded arbitrary 32-bit unsigned integers; and, if both are slightly negative values an attacker can trigger a heap overflow because of the integer wraps in the boundary check.
if (cdst-backbytes < dest | cdst+backsize >= dest+dsize) return -1; while(backsize--) { *cdst=*(cdst-backbytes); cdst++; }
Solution
Upgrade to version 0.86.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
