Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1745     It was discovered that a file descriptor leak in the CHM     handler may lead to denial of service.

  - CVE-2007-1997     It was discovered that a buffer overflow in the CAB     handler may lead to the execution of arbitrary code.

  - CVE-2007-2029     It was discovered that a file descriptor leak in the PDF     handler may lead to denial of service.

The version update to 0.90.2 fixes among other things two security problems (CVE-2007-1745, CVE-2007-1997).

iDefense discovered a stack-based overflow in ClamAV when processing negative values in .cab files. As well, multiple file descriptor leaks were also reported and fixed in chmunpack.c, pdf.c, and dblock.c.

This update provides ClamAV 0.90.2 which corrects these problems and provides new functionality.

The version update to 0.90.2 fixes among other things two security problems. (CVE-2007-1745 / CVE-2007-1997)

The remote host is affected by the vulnerability described in GLSA-200704-21 (ClamAV: Multiple vulnerabilities)

    iDefense Labs have reported a stack-based buffer overflow in the     cab_unstore() function when processing negative values in .cab files.
    Multiple file descriptor leaks have also been reported in chmunpack.c,     pdf.c and dblock.c when processing .chm files.
  Impact :

    A remote attacker could send a specially crafted CHM file to the     scanner, possibly resulting in the remote execution of arbitrary code     with the privileges of the user running ClamAV.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host is running the ClamAV antivirus client.

This version of ClamAV is vulnerable to multiple attack vectors.  The more serious of the flaws is a buffer overflow.  An attacker exploiting this flaw would need to be able to manipulate ClamAV to scan a malicious file (via email, web, etc.).  Successful exploitation would result in the attacker executing arbitrary code on the remote ClamAV scanner.  

ID	名稱	產品	系列	已發布	已更新	嚴重性
25098	Debian DSA-1281-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	2007/4/30	2021/1/4	high
27180	openSUSE 10 Security Update : clamav (clamav-3080)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
25189	Mandrake Linux Security Advisory : clamav (MDKSA-2007:098)	Nessus	Mandriva Local Security Checks	2007/5/10	2021/1/6	high
29400	SuSE 10 Security Update : clamav (ZYPP Patch Number 3081)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high
25109	GLSA-200704-21 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/4/30	2021/1/6	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	2008/3/19	2018/7/14	critical
3966	ClamAV < 0.90.2 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	2007/4/16	2019/3/6	medium

偵測

搜尋 Plugin

high

high

high

high

high

critical

medium