ClamAV Multiple Denial of Service Vulnerabilities

Posted on Thursday, August 23, 2007 @ 19:34:11 PDT in Security
by Raven

SECUNIA ADVISORY ID: SA26530

VERIFY ADVISORY: http://secunia.com/advisories/26530/

CRITICAL: Moderately critical

IMPACT: DoS

WHERE: >From remote

SOFTWARE: Clam AntiVirus (clamav) 0.x - http://secunia.com/product/2538/

DESCRIPTION: Some vulnerabilities have been reported in ClamAV, which can potentially be exploited by malicious people to cause a DoS (Denial of Service). The vulnerabilities are reported in versions prior to 0.91.2.

1) A NULL-pointer dereference error exists within the "cli_scanrtf()" function in libclamav/rtf.c. This can potentially be exploited to crash ClamAV via a specially crafted RTF file.

2) A NULL-pointer dereference error exists within the "cli_html_normalise()" function in libclamav/htmlnorm.c. This can potentially be exploited to crash ClamAV via a specially crafted HTML file containing a "data" URL scheme.

SOLUTION: Update to version 0.91.2. - http://sourceforge.net/project/showfiles.php?group_id=86638&package_id=90197&release_id=533658

PROVIDED AND/OR DISCOVERED BY:
1) Reported by the vendor.
2) The vendor credits Stefanos Stamatis.

ORIGINAL ADVISORY: http://sourceforge.net/project/shownotes.php?release_id=533658&group_id=86638
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 361,881,050
  • Today: 102,438
Server InfoServer Info
  • Jul 18, 2018
  • 11:00 pm PDT
 
 

Daily Inspiration