bugtraq - [ MDVSA-2009:327 ] clamav

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1NI3BN-0005GA-GK@titan.mandriva.com>
Date: Tue, 08 Dec 2009 17:45:01 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2009:327 ] clamav


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:327
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : clamav
 Date    : December 8, 2009
 Affected: 2008.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in clamav:
 
 Unspecified vulnerability in ClamAV before 0.95 allows remote
 attackers to bypass detection of malware via a modified RAR archive
 (CVE-2009-1241).
 
 libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause
 a denial of service (crash) via a crafted EXE file that triggers a
 divide-by-zero error (CVE-2008-6680).
 
 libclamav/untar.c in ClamAV before 0.95 allows remote attackers to
 cause a denial of service (infinite loop) via a crafted file that
 causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).
 
 The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1
 allows remote attackers to cause a denial of service (application
 crash) via a malformed file with UPack encoding (CVE-2009-1371).
 
 Stack-based buffer overflow in the cli_url_canon function in
 libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers
 to cause a denial of service (application crash) and possibly execute
 arbitrary code via a crafted URL (CVE-2009-1372).
 
 Important notice about this upgrade: clamav-0.95+ bundles support
 for RAR v3 in libclamav which is a license violation as the RAR v3
 license and the GPL license is not compatible. As a consequence to
 this Mandriva has been forced to remove the RAR v3 code.
 
 Packages for 2008.0 are being provided due to extended support for
 Corporate products.
 
 This update provides clamav 0.95.2, which is not vulnerable to these
 issues. Additionally klamav-0.46 is being provided that has support
 for clamav-0.95+.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6680
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1241
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1270
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1371
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1372
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 d4e8e17141e413c9e87a64b7181627e2  2008.0/i586/clamav-0.95.2-0.1mdv2008.0.i586.rpm
 9179be11ae65a206e3b1c6075836db93  2008.0/i586/clamav-db-0.95.2-0.1mdv2008.0.i586.rpm
 4d3b2e34434bb8ff057205f3575900a4  2008.0/i586/clamav-milter-0.95.2-0.1mdv2008.0.i586.rpm
 377e99d065097abc4b8a7e4817f4f9f1  2008.0/i586/clamd-0.95.2-0.1mdv2008.0.i586.rpm
 253062120fa32d9d42c9058516a72153  2008.0/i586/klamav-0.46-0.1mdv2008.0.i586.rpm
 9ef37702dc560d9941d982cfffeea6af  2008.0/i586/libclamav6-0.95.2-0.1mdv2008.0.i586.rpm
 b9aa169bb1ef5fcad2e59deea2cfbb41  2008.0/i586/libclamav-devel-0.95.2-0.1mdv2008.0.i586.rpm 
 b9a99dc63a69f9b4203fb95bc5d5ff12  2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm
 6a46b5c8bbf5429512e4b1924243526e  2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 4ac8f83b42541e50585c6ee6abd96ba8  2008.0/x86_64/clamav-0.95.2-0.1mdv2008.0.x86_64.rpm
 a1281d397120c7404f05d952dfa117b7  2008.0/x86_64/clamav-db-0.95.2-0.1mdv2008.0.x86_64.rpm
 8c1dc967687df31c29a01a43fcc487ed  2008.0/x86_64/clamav-milter-0.95.2-0.1mdv2008.0.x86_64.rpm
 109b738b88ebb607d2456ea1797d48cd  2008.0/x86_64/clamd-0.95.2-0.1mdv2008.0.x86_64.rpm
 b3dcaa53da6e1413924e2f1f3c611854  2008.0/x86_64/klamav-0.46-0.1mdv2008.0.x86_64.rpm
 2b7975248a809f3cfe9a2c5c7f0719f1  2008.0/x86_64/lib64clamav6-0.95.2-0.1mdv2008.0.x86_64.rpm
 3068f027586ef92661f8a6c60fd6ea3e  2008.0/x86_64/lib64clamav-devel-0.95.2-0.1mdv2008.0.x86_64.rpm 
 b9a99dc63a69f9b4203fb95bc5d5ff12  2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm
 6a46b5c8bbf5429512e4b1924243526e  2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLHlb7mqjQ0CJFipgRArB7AJ96vycVt/sc1YDwjmFkzl20gzfsRQCgsJEp
0vt39CYEd6o0ENF/6xMWYis=
=VxRu
-----END PGP SIGNATURE-----