search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Clam AntiVirus contains a buffer overflow vulnerability

Vulnerability Note VU#363713

Original Release Date: 2005-09-27 | Last Revised: 2005-11-03

Overview

A buffer overflow in Clam AntiVirus (ClamAV) may allow a remote attacker to execute arbitrary code.

Description

Clam AntiVirus is a UNIX-based, anti-virus toolkit often deployed with mail servers to detect malicious attachments. A signedness error in ClamAV (libclamav/upx.c) may allow a buffer overflow to occur. If a remote attacker sends a specially crafted UPX-packed executable to a vulnerable ClamAV installation, that attacker may be able to trigger the buffer overflow.

Impact

A remote attacker may be able to execute arbitrary code with the privileges of the application linked to the ClamAV process. In addition, this vulnerability may prevent ClamAV from detecting malicious UPX-packed executables.

Solution

Upgrade

This issue was corrected in ClamAV 0.87.

Do not access UPX-packed executables from untrusted sources

Exploitation occurs by via specially crafted UPX-packed executables. By only accessing UPX-packed executables from trusted or known sources, the chances of exploitation are reduced.

Vendor Information

363713
 
Expand all

View all 43 vendors View less vendors


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was reported by Thierry Carrez.

This document was written by Jeff Gennari.

Other Information

CVE IDs: CVE-2005-2920
Severity Metric: 6.75
Date Public: 2005-09-19
Date First Published: 2005-09-27
Date Last Updated: 2005-11-03 14:35 UTC
Document Revision: 45

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis