|
|
|
Vulnerability Note VU#599220ClamAV vulnerable to buffer overflow via malicious database mirrorOverviewThe Open Source anti-virus program ClamAV's update engine, freshclam, contains a buffer overflow vulnerability. If exploited, an attacker could create a denial-of-service condition, or possibly run arbitrary code with the privileges of the freshclam process.I. DescriptionFreshclam is a command line utility that installs and updates virus signatures that are used by the ClamAV anti-virus software. It uses the HTTP protocol to perform file downloads from various web servers that host virus signature updates.By directly changing one of the HTTP mirrors, or by using another means of redirecting the freshclam process to an attacker-controlled HTTP server, the attacker could cause a denial-of-service condition by sending an oversized HTTP header to the freshclam process. See the systems affected section of this document for information about specific vendors. Users who compile ClamAV from source are encouraged to upgrade to ClamAV version 0.88.2.
References
This document was written by Ryan Giobbi.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||
Get Adobe Reader