The remote host is affected by the vulnerability described in GLSA-200909-04 (Clam AntiVirus: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in ClamAV:
    The     vendor reported a Divide-by-zero error in the PE ('Portable     Executable'; Windows .exe) file handling of ClamAV     (CVE-2008-6680).
    Jeffrey Thomas Peckham found a flaw in     libclamav/untar.c, possibly resulting in an infinite loop when     processing TAR archives in clamd and clamscan (CVE-2009-1270).
    Martin Olsen reported a vulnerability in the CLI_ISCONTAINED macro     in libclamav/others.h, when processing UPack archives     (CVE-2009-1371).
    Nigel disclosed a stack-based buffer overflow     in the 'cli_url_canon()' function in libclamav/phishcheck.c when     processing URLs (CVE-2009-1372).
  Impact :

    A remote attacker could entice a user or automated system to process a     specially crafted UPack archive or a file containing a specially     crafted URL, possibly resulting in the remote execution of arbitrary     code with the privileges of the user running the application, or a     Denial of Service. Furthermore, a remote attacker could cause a Denial     of Service by supplying a specially crafted TAR archive or PE     executable to a Clam AntiVirus instance.
  Workaround :

    There is no known workaround at this time.

バージョンによると、リモートホストのclamdウイルス対策デーモンのバージョンは 0.95 より前です。該当するバージョンは、以下の複数の脆弱性の影響を受けます。

  - 特定の無効な形式の「RAR」アーカイブファイルの処理に失敗すると、特定のアーカイブファイルがスキャンエンジンからの検出を回避する可能性があります。（バグ1467）

  - 特定の不正な形式の「RAR」アーカイブファイルの処理に失敗すると、アプリケーションが無限ループに陥る可能性があり、これにより、スキャンエンジンがクラッシュする可能性があります。
    （バグ1462）

  - 特別に細工された「PE」ファイルを処理する際のゼロ除算の問題を利用して、影響を受けるアプリケーションがクラッシュする可能性があります。（バグ1335）

根據其版本，遠端主機上的 clamd 防毒程序版本比 0.95 舊。此類版本受到多個弱點影響：

  - 無法處理某些格式錯誤的「RAR」封存檔案，這可能會讓某些封存檔案規避掃描引擎的偵測。(錯誤 1467)

  - 無法處理某些格式錯誤的「RAR」封存檔案，這可將應用程式傳送至無限迴圈，進而可能導致掃描引擎當機。
    (錯誤 1462)

  - 處理特製的「PE」檔案時會發生除以零問題，攻擊者可利用此問題損毀受影響的應用程式。(錯誤 1335)

根据其版本，远程主机上的 clamd 防病毒后台程序低于 0.95。此类版本受到多个漏洞的影响：

  - 无法处理某些畸形“RAR”存档文件可能导致某些存档文件逃避扫描引擎的检测。（错误 1467）

  - 无法处理某些畸形“RAR”存档文件可将应用程序发送到无限循环，从而可导致扫描引擎崩溃。
    （错误 1462）

  - 处理特别构建的“PE”文件时出现的除零问题可被用于导致受影响的应用程序崩溃。（错误 1335）

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95. Such versions are affected by multiple vulnerabilities :

  - A failure to handle certain malformed 'RAR' archive     files could make it possible for certain archive files     to     evade detection from the scan engine. (Bug 1467)

  - A failure to handle certain malformed 'RAR' archive     files could send the application into an infinite loop,     which could make it possible to crash the scan engine.
    (Bug 1462)

  - A divide by zero issue when handling specially crafted     'PE' file could be used to crash the affected     application. (Bug 1335)

Several vulnerabilities have been discovered in the ClamAV anti-virus toolkit :

  - CVE-2008-6680     Attackers can cause a denial of service (crash) via a     crafted EXE file that triggers a divide-by-zero error.

  - CVE-2009-1270     Attackers can cause a denial of service (infinite loop)     via a crafted tar file that causes (1) clamd and (2)     clamscan to hang.

  - (no CVE Id yet)

    Attackers can cause a denial of service (crash) via a     crafted EXE file that crashes the UPack unpacker.

It was discovered that ClamAV did not properly verify its input when processing TAR archives. A remote attacker could send a specially crafted TAR file and cause a denial of service via infinite loop.
(CVE-2009-1270)

It was discovered that ClamAV did not properly validate Portable Executable (PE) files. A remote attacker could send a crafted PE file and cause a denial of service (divide by zero). (CVE-2008-6680).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

This update provides clamav 0.95.1, which is not vulnerable to these issues.

Multiple vulnerabilities has been found and corrected in clamav :

Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides clamav 0.95.2, which is not vulnerable to these issues. Additionally klamav-0.46 is being provided that has support for clamav-0.95+.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied.

This security update contains fixes for the following products :

  - Alias Manager
  - CarbonCore
  - ClamAV
  - ColorSync
  - CoreGraphics
  - CUPS
  - Flash Player plug-in
  - ImageIO
  - Launch Services
  - MySQL
  - PHP
  - SMB
  - Wiki Server

According to its version, the clamd antivirus daemon on the remote host is earlier than 0.95.  Such versions fail to handle certain  malformed 'RAR' archive files, and hence it may be possible for certain archive files to evade detection from the scan engine. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
40912	GLSA-200909-04 : Clam AntiVirus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/9/10	2021/1/6	critical
36075	ClamAV < 0.95のスキャン回避	Nessus	Misc.	2009/4/2	2018/11/15	medium
36075	ClamAV < 0.95 掃描規避	Nessus	Misc.	2009/4/2	2018/11/15	medium
36075	ClamAV < 0.95 扫描规避	Nessus	Misc.	2009/4/2	2018/11/15	medium
36075	ClamAV < 0.95 Scan Evasion	Nessus	Misc.	2009/4/2	2018/11/15	medium
36164	Debian DSA-1771-1 : clamav - several vulnerabilities	Nessus	Debian Local Security Checks	2009/4/16	2021/1/4	high
37498	Ubuntu 8.10 : clamav vulnerabilities (USN-754-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	high
38165	Mandriva Linux Security Advisory : clamav (MDVSA-2009:097)	Nessus	Mandriva Local Security Checks	2009/4/27	2021/1/6	critical
43076	Mandriva Linux Security Advisory : clamav (MDVSA-2009:327)	Nessus	Mandriva Local Security Checks	2009/12/9	2021/1/6	critical
40945	Mac OS X Multiple Vulnerabilities (Security Update 2009-005)	Nessus	MacOS X Local Security Checks	2009/9/11	2024/5/28	critical
4982	ClamAV < 0.95 Scan Evasion (deprecated)	Nessus Network Monitor	Web Clients	2009/4/3	2019/3/6	high

偵測

搜尋 Plugin

critical

medium

medium

medium

medium

high

high

critical

critical

critical

high