Vulnerability Note VU#599220

ClamAV vulnerable to buffer overflow via malicious database mirror

Original Release date: 28 Jun 2006 | Last revised: 29 Jun 2006


The Open Source anti-virus program ClamAV's update engine, freshclam, contains a buffer overflow vulnerability. If exploited, an attacker could create a denial-of-service condition, or possibly run arbitrary code with the privileges of the freshclam process.


Freshclam is a command line utility that installs and updates virus signatures that are used by the ClamAV anti-virus software. It uses the HTTP protocol to perform file downloads from various web servers that host virus signature updates.

By directly changing one of the HTTP mirrors, or by using another means of redirecting the freshclam process to an attacker-controlled HTTP server, the attacker could cause a denial-of-service condition by sending an oversized HTTP header to the freshclam process.

Note that ClamAV and freshclam server and client programs are available for Microsoft Windows, Linux, Apple OS X, and BSD operating systems.


A remote attacker may create a denial-of-service condition. The vendor reports that remote execution of arbitrary code would not be easy due to diversity of client platforms and architectures.


See the systems affected section of this document for information about specific vendors. Users who compile ClamAV from source are encouraged to upgrade to ClamAV version 0.88.2.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
SUSE LinuxAffected-28 Jun 2006
Clam AntiVirusUnknown-28 Jun 2006
Debian GNU/LinuxUnknown-28 Jun 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: CVE-2006-1989
  • Date Public: 27 Jun 2006
  • Date First Published: 28 Jun 2006
  • Date Last Updated: 29 Jun 2006
  • Severity Metric: 0.11
  • Document Revision: 28


If you have feedback, comments, or additional information about this vulnerability, please send us email.