ClamAV: Heap buffer overflow — GLSA 200608-13

ClamAV is vulnerable to a heap-based buffer overflow resulting in a Denial of Service and potentially remote execution of arbitrary code.

Affected packages

Background

ClamAV is a GPL virus scanner.

Description

Damian Put has discovered a boundary error in the pefromupx() function used by the UPX extraction module, which unpacks PE Windows executable files. Both the "clamscan" command-line utility and the "clamd" daemon are affected.

Impact

By sending a malicious attachment to a mail server running ClamAV, a remote attacker can cause a Denial of Service and potentially the execution of arbitrary code with the permissions of the user running ClamAV.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.88.4"

References

• ClamAV security advisory
• CVE-2006-4018

Release date
August 08, 2006

Latest revision
August 08, 2006: 02

Severity
high

Exploitable
remote

Bugzilla entries

• 143093