Bug 580464 (CVE-2010-0098)

Summary:	CVE-2010-0098 Clam AntiVirus (prior to v0.96): Anti-virus scanning functionality bypass via specially-crafted archive files
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rh-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1826
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-08 20:02:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	580676
Bug Blocks:

Description Jan Lieskovsky 2010-04-08 10:36:44 UTC

ReversingLabs Corp reported a deficiency in the way Clam AntiVirus
checked / scanned ZIP, CAB, 7Z and RAR archive files for presence
of viruses. Providing a specially-crafted archive file could
allow an attacker to bypass the traditional viruses detection
mechanisms (resulting in archive with malicious content to be
considered as valid).

Upstream bug report:
  [1] https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1826

Upstream patch:
  [2] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=158c35e81a25ea5fda55a2a7f62ea9fec2e883d9

References:
  [3] http://secunia.com/advisories/39329/

Credit:
  ReversingLabs Corp

Comment 1 Jan Lieskovsky 2010-04-08 10:55:45 UTC

This issue affects the versions of the clamav package,
as shipped with Fedora release of 11 and 12.

This issue affects the versions of the clamav package,
as present in EPEL-4 and EPEL-5 repositories.

Please fix.

Comment 2 Jan Lieskovsky 2010-04-08 18:41:48 UTC

Created Fedora tracking bugs for clamav:

All versions: bug #580676