full-disclosure - [USN-672-1] ClamAV vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20081117232735.GV11234@outflux.net>
Date: Mon, 17 Nov 2008 15:27:35 -0800
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-672-1] ClamAV vulnerability

===========================================================
Ubuntu Security Notice USN-672-1          November 17, 2008
clamav vulnerability
CVE-2008-5050
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
  libclamav5                      0.94.dfsg.1-1ubuntu0.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Moritz Jodeit discovered that ClamAV did not correctly handle certain
strings when examining a VBA project.  If a remote attacker tricked ClamAV
into processing a malicious VBA file, ClamAV would crash, leading to a
denial of service.


Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1.diff.gz
      Size/MD5:   159057 5725cf706bede729fee19476cc9e2da0
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1.dsc
      Size/MD5:     1545 75621bacb9181c1c842b22981898238c
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1.orig.tar.gz
      Size/MD5: 21796733 8637ed043ce1408486dbe31a5344cfcf

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-base_0.94.dfsg.1-1ubuntu0.1_all.deb
      Size/MD5: 19211410 b7e5c9d9ee4691f4e93054c2ab517a0c
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.94.dfsg.1-1ubuntu0.1_all.deb
      Size/MD5:  1074804 bf77b6af599f0c6476aeba4f808433f2
    http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-testfiles_0.94.dfsg.1-1ubuntu0.1_all.deb
      Size/MD5:   206308 d2ac10476deec6bea5aa5f8628e1066b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   238464 7330c3a5f0e6d7615c56c22fb3f60cd9
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   912708 3f1a630610744f4d782fa5c6c4f8fb5f
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   254032 b4249de030a3ee71d64700fa7d59bc38
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   234326 8a636c5942b657a566b5d4e5050c0a2f
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   572450 7b04385426af19980c51b428ab314774
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   536116 8e440dd7d4df3db94a1595cfb942f581
    http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_amd64.deb
      Size/MD5:   231076 f6d9ff56d2dc01bc5c585a5fc269c1a1

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   232060 ade517407bfcf7d4a15bdfa4ae15301d
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   847264 aed581aca9429be3a857a7074b7f4348
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   251774 4b00cbf18c30516c1c2309294f827ea9
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   231404 7bba604ae5afba8c954f9ef6a02638f3
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   540806 f13d6f105fcd6cadac12978fcde8b6aa
    http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   522518 37c2a34e5165f0f0bc122c3017f31b8e
    http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_i386.deb
      Size/MD5:   227676 0ae5263b659a694564a38be262eafd98

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   231546 074471493c489d01d3d63778751e9567
    http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   864428 6ac51e226ad6687f9ee9fa356196bf7d
    http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   251994 87cf67b1a17b2084a746c5a145fa4905
    http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   231002 1379749a34b4ef43155c269e02dbaff0
    http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   542558 e25d965122c1e81ecb97b567f88c86c7
    http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   524940 26042475abe9e464e402faa6aac190d8
    http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_lpia.deb
      Size/MD5:   227628 b52e069ee4517c06b95b4b14b95aa59e

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   241772 99a6d9e681de4b13ad3cb60837ca6147
    http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   901744 f1d81f00fa0bbf7775bdad0edb2ec4d4
    http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   256908 c41e8695f170564262200f7e62a7b957
    http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   238986 5b6a5ea03e02bcbbb9fa598bff76c79a
    http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   612932 b0e9af13089554bf808c471692191048
    http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   553138 c98be80704783e5ec7fcf608d20e1eae
    http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
      Size/MD5:   231198 b535583753ffe6cc73f7e4a4f20376ee

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   231630 84ba5b875cb67290c8501ba825199deb
    http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   834302 ed63e23fc9ce4073b14302f2553e4dad
    http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   251206 f3d18a9ca20dec1a7c5e4046c4fd89f1
    http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   231864 5b3aef13761da33bb45e5de6e78fe49c
    http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   576800 361eaadd291deefe4c31ed10ba60a4f2
    http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   541528 63793c6742c24ea9eae47ba641dd3cf0
    http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_sparc.deb
      Size/MD5:   228470 7c446c73a80ac31c703a26bed6e1117f


Download attachment "signature.asc" of type "application/pgp-signature" (236 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/