bugtraq - Re: ClamAV Multiple Rem0te Buffer Overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200508031837.j73IbgSb027567@linus.mitre.org>
Date: Wed, 3 Aug 2005 14:37:42 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: ClamAV Multiple Rem0te Buffer Overflows

>The release notes for 0.86.2 say:
>
>"Changes in this release include fixes for three possible integer
>overflows in libclamav"

Simply assuming that a single-line changelog entry is sufficient
acknowledgement of a published vulnerability is dangerous.  Such
assumptions are frequently wrong.  (However, in this case, Alex
Wheeler is credited in the more detailed changelog in the release
notes).

However...

The original advisory said:

  "At least 4 of its file format processors contain remote security
   bugs."

But then the advisory only lists 3 formats.

So, was this just a typo by the researchers?  Or are there really 4
bugs, and the latest release still has one bug that hasn't been fixed
yet?

This demonstrates one of the Four I's of security advisory problems,
namely Inconsistency.  The other three are Inaccurate, Incomplete, or
Incomprehensible.

- Steve