Bug 245219 (CVE-2007-3123)

Summary:	clamav < 0.90.3 multiple vulnerabilities
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	clamav	Assignee:	Enrico Scholz <rh-bugzilla>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7	CC:	crow, fedora-security-list, ondrejj
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	clamav-0.91.2-3.fc7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-11-01 20:34:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2007-06-21 18:38:11 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3023
"unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly
calculate the end of a certain buffer, with unknown impact and remote attack
vectors."

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3024
"libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses
insecure permissions for temporary files that are created by the
cli_gentempstream function in clamd/clamdscan, which might allow local users to
read sensitive files."

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3122
"The parsing engine in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows
remote attackers to bypass scanning via a RAR file with a header flag value of
10, which can be processed by WinRAR."

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3123
"unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows
remote attackers to cause a denial of service (core dump) via a crafted RAR file
with a modified vm_codesize value, which triggers a heap-based buffer overflow."

Not checked whether 0.88.x in FC-6 and earlier are affected.

Comment 1 Ville Skyttä 2007-07-19 18:01:22 UTC

One more that I didn't find in Bugzilla and apparently affects 0.90.x series
earlier than 0.90.3:

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2029
"File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows
remote attackers to cause a denial of service via a crafted PDF file."

Comment 2 Jan ONDREJ 2007-08-30 07:39:33 UTC

Another problem is, that freshclam is writing to logs this:
Reading CVD header (daily.cvd): Ignoring mirror 212.7.0.71 (too often connection
s with outdated version)

I think updating is not working properly. This does not happen always and I am
unable to reproduce this on other machine.

And last problem, libclamav is loading it's database a long time (aprox. 2-5
minutes). This bug can be also fixed with upgrade to clamav 0.91.

What is the problem with releasing clamav-0.91.2 built in Koji?

How can I help to release clamav updates with less time? My Fedora system is
vulnerable to some vulnerabilities with old clamav. :-(