CVE-2005-2920
CVSS7.5
发布时间 :2005-09-20 19:03:00
修订时间 :2011-03-07 21:25:17
NMCOPS    

[原文]Buffer overflow in libclamav/upx.c in Clam AntiVirus (ClamAV) before 0.87 allows remote attackers to execute arbitrary code via a crafted UPX packed executable.


[CNNVD]ClamAV libclamav/upx.c缓冲区溢出漏洞(CNNVD-200509-172)

        Clam AntiVirus(ClamAV)是免费而且开放源代码的防毒软件,软件与病毒码的的更新皆由社群免费发布。
        Clam AntiVirus (ClamAV) 0.87之前版本中的libclamav/upx.c发生的缓冲区溢出允许远程攻击者通过伪造UPX压缩可执行文件来执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:clam_anti-virus:clamav:0.86
cpe:/a:clam_anti-virus:clamav:0.73
cpe:/a:clam_anti-virus:clamav:0.81
cpe:/a:clam_anti-virus:clamav:0.85
cpe:/a:clam_anti-virus:clamav:0.72
cpe:/a:clam_anti-virus:clamav:0.75
cpe:/a:clam_anti-virus:clamav:0.70
cpe:/a:clam_anti-virus:clamav:0.71
cpe:/a:clam_anti-virus:clamav:0.84
cpe:/a:clam_anti-virus:clamav:0.80
cpe:/a:clam_anti-virus:clamav:0.86.2
cpe:/a:clam_anti-virus:clamav:0.75.1
cpe:/a:clam_anti-virus:clamav:0.86.1
cpe:/a:clam_anti-virus:clamav:0.82
cpe:/a:clam_anti-virus:clamav:0.74
cpe:/a:clam_anti-virus:clamav:0.85.1
cpe:/a:clam_anti-virus:clamav:0.83

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2920
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2920
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200509-172
(官方数据源) CNNVD

- 其它链接及资源

http://www.kb.cert.org/vuls/id/363713
(UNKNOWN)  CERT-VN  VU#363713
http://www.gentoo.org/security/en/glsa/glsa-200509-13.xml
(VENDOR_ADVISORY)  GENTOO  GLSA-200509-13
http://sourceforge.net/project/shownotes.php?release_id=356974
(PATCH)  CONFIRM  http://sourceforge.net/project/shownotes.php?release_id=356974
http://www.vupen.com/english/advisories/2005/1774
(UNKNOWN)  VUPEN  ADV-2005-1774
http://xforce.iss.net/xforce/xfdb/22307
(UNKNOWN)  XF  clam-antivirus-upx-bo(22307)
http://www.securityfocus.com/bid/14866
(UNKNOWN)  BID  14866
http://www.osvdb.org/19506
(UNKNOWN)  OSVDB  19506
http://www.novell.com/linux/security/advisories/2005_55_clamav.html
(UNKNOWN)  SUSE  SUSE-SA:2005:055
http://www.debian.org/security/2005/dsa-824
(UNKNOWN)  DEBIAN  DSA-824
http://secunia.com/advisories/16989
(UNKNOWN)  SECUNIA  16989
http://secunia.com/advisories/16848
(UNKNOWN)  SECUNIA  16848

- 漏洞信息

ClamAV libclamav/upx.c缓冲区溢出漏洞
高危 缓冲区溢出
2005-09-20 00:00:00 2005-10-20 00:00:00
远程  
        Clam AntiVirus(ClamAV)是免费而且开放源代码的防毒软件,软件与病毒码的的更新皆由社群免费发布。
        Clam AntiVirus (ClamAV) 0.87之前版本中的libclamav/upx.c发生的缓冲区溢出允许远程攻击者通过伪造UPX压缩可执行文件来执行任意代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        Clam Anti-Virus ClamAV 0.51版
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.52
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.53
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.54
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.60
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.65
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.67
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.68
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=8663
        Clam Anti-Virus ClamAV 0.68 -1
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.70
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.80 rc3
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.80 rc1
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.80 rc2
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        
        Clam Anti-Virus ClamAV 0.80 rc4
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.80
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.81
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.82
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Clam Anti-Virus ClamAV 0.83
        Clam Anti-Virus ClamAV 0.87
        http://sourceforge.net/project/showfiles.php?group_id=86638
        Mandriva clamav-0.87-0.1.102mdk.i586.rpm
        Mandrakelinux 10.2:
        http://www1.mandrivalinux.com/en/ftp.php3

- 漏洞信息 (F40359)

Debian Linux Security Advisory 824-1 (PacketStormID:F40359)
2005-10-04 00:00:00
Debian  security.debian.org
advisory,vulnerability
linux,unix,debian
CVE-2005-2919,CVE-2005-2920
[点击下载]

Debian Security Advisory DSA 824-1 - Two vulnerabilities have been discovered in Clam AntiVirus, the antivirus scanner for Unix, designed for integration with mail servers to perform attachment scanning. The following problems were identified:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 824-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
September 29th, 2005                    http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : clamav
Vulnerability  : infinite loop, buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CAN-2005-2919 CAN-2005-2920
Debian Bug     : 328660

Two vulnerabilities have been discovered in Clam AntiVirus, the
antivirus scanner for Unix, designed for integration with mail servers
to perform attachment scanning.  The following problems were
identified:

CAN-2005-2919

    A potentially infinite loop could lead to a denial of service.

CAN-2005-2920

    A buffer overflow could lead to a denial of service.

The old stable distribution (woody) does not contain ClamAV packages.

For the stable distribution (sarge) these problems have been fixed in
version 0.84-2.sarge.4.

For the unstable distribution (sid) these problems have been fixed in
version 0.87-1.

We recommend that you upgrade your clamav package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4.dsc
      Size/MD5 checksum:      872 1a1aaa3318ae10c6806f582588e307bb
    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4.diff.gz
      Size/MD5 checksum:   175215 e44e7c828b916a87c94985cf8eae3d13
    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84.orig.tar.gz
      Size/MD5 checksum:  4006624 c43213da01d510faf117daa9a4d5326c

  Architecture independent components:

    http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.84-2.sarge.4_all.deb
      Size/MD5 checksum:   154302 764277db36650876f13658e2e5f0751b
    http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.84-2.sarge.4_all.deb
      Size/MD5 checksum:   689924 e5aba73a0a6f949f7ddf2e6efa6b0aeb
    http://security.debian.org/pool/updates/main/c/clamav/clamav-testfiles_0.84-2.sarge.4_all.deb
      Size/MD5 checksum:   123298 5792bbcedba7c7b19b118976c23d7dff

  Alpha architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_alpha.deb
      Size/MD5 checksum:    74672 e6725d68591dd710cce840b8020647c9
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_alpha.deb
      Size/MD5 checksum:    48792 ab341735b610360d211d93aae21f8c04
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_alpha.deb
      Size/MD5 checksum:  2176364 57135c04ea09bb8571e1fcb31db492e0
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_alpha.deb
      Size/MD5 checksum:    42112 d9881a7457c16df6c279e3de6715a8c1
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_alpha.deb
      Size/MD5 checksum:   254516 d8dff4ba494bb9dcfa1a2be51c0b3a8c
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_alpha.deb
      Size/MD5 checksum:   283868 4cf4e2c9a673c679af6d53cd19fd86e2

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_amd64.deb
      Size/MD5 checksum:    68858 e1cf55557564afe9eb85b8028ed95576
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_amd64.deb
      Size/MD5 checksum:    44188 f043d16b9b1fa8755fb27b97b24bfa6c
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_amd64.deb
      Size/MD5 checksum:  2173194 9c1766d7351dea3e1c6529b77c03e3e4
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_amd64.deb
      Size/MD5 checksum:    40006 2407a0b2ca24d6bf745c2bd9c509a7e8
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_amd64.deb
      Size/MD5 checksum:   175354 2fb4df2228763488f9fbb5b6ae52d38e
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_amd64.deb
      Size/MD5 checksum:   257910 ce9eef9c38187a70582528ef6a99f9e6

  ARM architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_arm.deb
      Size/MD5 checksum:    63824 d6cb239e323084cfc6b5a30f36a52c01
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_arm.deb
      Size/MD5 checksum:    39520 76997f2c09141dfc517570f0c0f77598
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_arm.deb
      Size/MD5 checksum:  2171212 6b64588c64a58e275b226a8289cbffd3
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_arm.deb
      Size/MD5 checksum:    37304 8f29746edb67c02477b662b473ac4234
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_arm.deb
      Size/MD5 checksum:   173526 02a315f3ad72931252a2fcfaf7682561
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_arm.deb
      Size/MD5 checksum:   248328 7de5f21da6ebd76b9e6bce64b1935df9

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_i386.deb
      Size/MD5 checksum:    65124 f53eadb97b80d0b2f7c8a8f6d15c7fcc
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_i386.deb
      Size/MD5 checksum:    40194 11affc953259da108bb6ac9015703c9a
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_i386.deb
      Size/MD5 checksum:  2171518 136c46a06385fbb5e8d896d642bc0f05
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_i386.deb
      Size/MD5 checksum:    38030 ef402381cb175820ea4b0c01d2974b54
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_i386.deb
      Size/MD5 checksum:   158546 89741c1bf059281f1ca2aa0dd7f40861
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_i386.deb
      Size/MD5 checksum:   252594 60e13cb2197362fbda1d8d122b841cfe

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_ia64.deb
      Size/MD5 checksum:    81706 8267ad55e4b5b58bf80911973a635e02
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_ia64.deb
      Size/MD5 checksum:    55102 f90bc4bac2fed23429feecdbe92fb850
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_ia64.deb
      Size/MD5 checksum:  2180084 0200268cac161cc694f2eb87e050521a
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_ia64.deb
      Size/MD5 checksum:    49208 f143c1c98036aa4d404c8c9c9b533e33
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_ia64.deb
      Size/MD5 checksum:   250412 12a7b80cc296d1825ff40c297f7b2592
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_ia64.deb
      Size/MD5 checksum:   315812 a8e46a8c22ab740d51b80da4edcbde8d

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_hppa.deb
      Size/MD5 checksum:    68182 9b08058ca6bdfc769a091c7c89a7ce64
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_hppa.deb
      Size/MD5 checksum:    43234 4ebf553bf0a02e8179260d04c7dd7238
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_hppa.deb
      Size/MD5 checksum:  2173616 d8d57d8b12fddd5c9ea61b5affdfb34e
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_hppa.deb
      Size/MD5 checksum:    39450 adffa3c170aea391e410e997f57cf535
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_hppa.deb
      Size/MD5 checksum:   201266 29b0927ba2b89df397423e6e520cfa1f
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_hppa.deb
      Size/MD5 checksum:   281814 4916e2bb671314195cf51e50c375101d

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_m68k.deb
      Size/MD5 checksum:    62456 f83ffc5a1b29336b95d29480976f3229
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_m68k.deb
      Size/MD5 checksum:    38072 237a81f8ae94f568a7ab288b01d7294b
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_m68k.deb
      Size/MD5 checksum:  2170454 38f3c19b1d3600361a3eff93b2c08924
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_m68k.deb
      Size/MD5 checksum:    35068 d54fa55db1fe03921ce0e080946a3006
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_m68k.deb
      Size/MD5 checksum:   145372 27ff086da84d8b2b7e1a7b5e0ec6faad
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_m68k.deb
      Size/MD5 checksum:   249018 8ec76ffcdd22dc2216b29c0a5b0967b2

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_mips.deb
      Size/MD5 checksum:    67858 ff8ac22975ec3987744b41635334032a
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_mips.deb
      Size/MD5 checksum:    43674 3672906fe3fde3bc7a94ad54c47d07d4
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_mips.deb
      Size/MD5 checksum:  2172970 a8580f8e196acba4d9d625c4cc423338
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_mips.deb
      Size/MD5 checksum:    37670 ccdc395e404f330c20598d5b02ddaf49
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_mips.deb
      Size/MD5 checksum:   194320 bb910353a34fea0942afab88a31d7dea
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_mips.deb
      Size/MD5 checksum:   256088 7ec97820fa2470e7b58bf2d3b7d5c696

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_mipsel.deb
      Size/MD5 checksum:    67478 b78451c1753da62285c74c07e0fe263f
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_mipsel.deb
      Size/MD5 checksum:    43488 06e92d862ef6cd8a6ecd20f3537c4d7b
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_mipsel.deb
      Size/MD5 checksum:  2172916 f5a1eee003eb3995b97fe10b4ea09809
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_mipsel.deb
      Size/MD5 checksum:    37958 6cdc8361e786e419383ca407b287c65b
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_mipsel.deb
      Size/MD5 checksum:   190670 c464b1c69c97529361b0317d5db6fdc5
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_mipsel.deb
      Size/MD5 checksum:   253560 b892c53f46239ed94dc23d74c7958b06

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_powerpc.deb
      Size/MD5 checksum:    69226 dd9cc43999a009d6df890de345a692cd
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_powerpc.deb
      Size/MD5 checksum:    44584 58799c4b2e083df36b7a70d6b084d026
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_powerpc.deb
      Size/MD5 checksum:  2173556 bb02308f91a0b63bb560db20973d28f7
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_powerpc.deb
      Size/MD5 checksum:    38876 09a8c78537033a725fba8214735b5882
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_powerpc.deb
      Size/MD5 checksum:   186618 459c027d740cf25932665586f55a68ff
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_powerpc.deb
      Size/MD5 checksum:   263206 5a0fa00dd636ae40a62f0e02d63bc19b

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_s390.deb
      Size/MD5 checksum:    67772 1ec4fd75cf9b37c1b124e14cad82d75e
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_s390.deb
      Size/MD5 checksum:    43434 1e0ce0535300f7176e550df27af61097
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_s390.deb
      Size/MD5 checksum:  2172868 3884882c922c7a32b4d486545400b384
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_s390.deb
      Size/MD5 checksum:    38934 a85a83dfd24e7fd3ebb8236782273c36
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_s390.deb
      Size/MD5 checksum:   181596 c419b59dc3bad8208f6d0c4ff9248e13
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_s390.deb
      Size/MD5 checksum:   267778 00ea85457a4457d7539f9e939fa38524

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.4_sparc.deb
      Size/MD5 checksum:    64334 9e1a24f503ce5d8ef70798f0dad6714a
    http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.4_sparc.deb
      Size/MD5 checksum:    39392 7eaf2f1afd3bd2ab143f5b5f78cdd51b
    http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.4_sparc.deb
      Size/MD5 checksum:  2171076 e9e6a7aa3e48315dd9905e407ed6b969
    http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.4_sparc.deb
      Size/MD5 checksum:    36854 1d81507b5ee8ae42506dad08b6a9a452
    http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.4_sparc.deb
      Size/MD5 checksum:   174900 a6a7fcfed104d7351832f7eba3b5e6b1
    http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.4_sparc.deb
      Size/MD5 checksum:   263458 4f26cd6ff0466652766d7ce5ae183a63


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDO9c1W5ql+IAeqTIRAngGAJ0e0cAiQPXIm9Vi0Rp0cSYc8kRQEgCdG8vt
1IRu7XWrqRONnuYZ/JQkEIU=
=zeaO
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
    

- 漏洞信息 (F40171)

Gentoo Linux Security Advisory 200509-13 (PacketStormID:F40171)
2005-09-22 00:00:00
Gentoo  security.gentoo.org
advisory,overflow
linux,gentoo
CVE-2005-2919,CVE-2005-2920
[点击下载]

Gentoo Linux Security Advisory GLSA 200509-13 - Clam AntiVirus is vulnerable to a buffer overflow in libclamav/upx.c when processing malformed UPX-packed executables. It can also be sent into an infinite loop in libclamav/fsg.c when processing specially-crafted FSG-packed executables. Versions less than 0.87 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200509-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: Clam AntiVirus: Multiple vulnerabilities
      Date: September 19, 2005
      Bugs: #106279
        ID: 200509-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Clam AntiVirus is subject to vulnerabilities ranging from Denial of
Service to execution of arbitrary code when handling compressed
executables.

Background
==========

Clam AntiVirus is a GPL anti-virus toolkit, designed for integration
with mail servers to perform attachment scanning. Clam AntiVirus also
provides a command line scanner and a tool for fetching updates of the
virus database.

Affected packages
=================

    -------------------------------------------------------------------
     Package               /  Vulnerable  /                 Unaffected
    -------------------------------------------------------------------
  1  app-antivirus/clamav       < 0.87                         >= 0.87

Description
===========

Clam AntiVirus is vulnerable to a buffer overflow in "libclamav/upx.c"
when processing malformed UPX-packed executables. It can also be sent
into an infinite loop in "libclamav/fsg.c" when processing
specially-crafted FSG-packed executables.

Impact
======

By sending a specially-crafted file an attacker could execute arbitrary
code with the permissions of the user running Clam AntiVirus, or cause
a Denial of Service.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Clam AntiVirus users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.87"

References
==========

  [ 1 ] CAN-2005-2919
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2919
  [ 2 ] CAN-2005-2920
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2920
  [ 3 ] Clam AntiVirus: Release Notes
        http://sourceforge.net/project/shownotes.php?release_id=356974

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200509-13.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

    

- 漏洞信息

19506
Clam AntiVirus libclamav/upx.c UPX Processing Overflow
Input Manipulation
Loss of Integrity Upgrade
Vendor Verified

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-09-19 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 0.87 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

ClamAV UPX Compressed Executable Buffer Overflow Vulnerability
Boundary Condition Error 14866
Yes No
2005-09-16 12:00:00 2006-12-20 10:37:00
Discovery is credited to an anonymous source.

- 受影响的程序版本

Trustix Secure Linux 3.0
Trustix Secure Linux 2.2
Conectiva Linux 10.0
Clam Anti-Virus ClamAV 0.86.2
Clam Anti-Virus ClamAV 0.86 .1
Clam Anti-Virus ClamAV 0.86
Clam Anti-Virus ClamAV 0.85.1
Clam Anti-Virus ClamAV 0.85
Clam Anti-Virus ClamAV 0.84 rc2
Clam Anti-Virus ClamAV 0.84 rc1
Clam Anti-Virus ClamAV 0.84
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
Clam Anti-Virus ClamAV 0.83
Clam Anti-Virus ClamAV 0.82
Clam Anti-Virus ClamAV 0.81
+ Gentoo Linux
Clam Anti-Virus ClamAV 0.80 rc4
Clam Anti-Virus ClamAV 0.80 rc3
Clam Anti-Virus ClamAV 0.80 rc2
Clam Anti-Virus ClamAV 0.80 rc1
Clam Anti-Virus ClamAV 0.80
Clam Anti-Virus ClamAV 0.75.1
Clam Anti-Virus ClamAV 0.70
Clam Anti-Virus ClamAV 0.68 -1
Clam Anti-Virus ClamAV 0.68
Clam Anti-Virus ClamAV 0.67
+ Gentoo Linux 1.4 _rc3
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.4
Clam Anti-Virus ClamAV 0.65
Clam Anti-Virus ClamAV 0.60
Clam Anti-Virus ClamAV 0.54
Clam Anti-Virus ClamAV 0.53
Clam Anti-Virus ClamAV 0.52
Clam Anti-Virus ClamAV 0.51
Clam Anti-Virus ClamAV 0.87

- 不受影响的程序版本

Clam Anti-Virus ClamAV 0.87

- 漏洞讨论

ClamAV is prone to a remote buffer-overflow vulnerability. This condition occurs when the program processes malformed UPX-compressed executables.

Successful exploitation may result in the execution of arbitrary code in the context of the application.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

- 解决方案


Please see the referenced vendor advisories for more information.


Clam Anti-Virus ClamAV 0.51

Clam Anti-Virus ClamAV 0.52

Clam Anti-Virus ClamAV 0.53

Clam Anti-Virus ClamAV 0.54

Clam Anti-Virus ClamAV 0.60

Clam Anti-Virus ClamAV 0.65

Clam Anti-Virus ClamAV 0.67

Clam Anti-Virus ClamAV 0.68

Clam Anti-Virus ClamAV 0.68 -1

Clam Anti-Virus ClamAV 0.70

Clam Anti-Virus ClamAV 0.75.1

Clam Anti-Virus ClamAV 0.80 rc3

Clam Anti-Virus ClamAV 0.80 rc1

Clam Anti-Virus ClamAV 0.80 rc2

Clam Anti-Virus ClamAV 0.80 rc4

Clam Anti-Virus ClamAV 0.80

Clam Anti-Virus ClamAV 0.81

Clam Anti-Virus ClamAV 0.82

Clam Anti-Virus ClamAV 0.83

Clam Anti-Virus ClamAV 0.84 rc2

Clam Anti-Virus ClamAV 0.84

Clam Anti-Virus ClamAV 0.84 rc1

Clam Anti-Virus ClamAV 0.85

Clam Anti-Virus ClamAV 0.85.1

Clam Anti-Virus ClamAV 0.86 .1

Clam Anti-Virus ClamAV 0.86

Clam Anti-Virus ClamAV 0.86.2

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站