Bug 806097 (CVE-2012-1443)

Summary: CVE-2012-1443 clamav: specially-crafted RAR files evade detection
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: janfrode, nb, ondrejj, redhat-bugzilla, rh-bugzilla, steve
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-01-29 23:04:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 806102, 806103    
Bug Blocks:    

Description Vincent Danen 2012-03-22 21:09:34 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1443 to
the following vulnerability:

Name: CVE-2012-1443
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1443
Assigned: 20120229
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
Reference: http://www.securityfocus.com/archive/1/522005
Reference: http://www.ieee-security.org/TC/SP2012/program.html

The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03,
Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine
20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus
5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0,
Emsisoft Anti-Malware 5.1.0.1, PC Tools AntiVirus 7.0.3.5, F-Prot
Antivirus 4.6.2.117, VirusBuster 13.6.151.0, Fortinet Antivirus
4.2.254.0, Antiy Labs AVL SDK 2.0.3.7, K7 AntiVirus 9.77.3565, Trend
Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Jiangmin
Antivirus 13.0.900, Antimalware Engine 1.1.6402.0 in Microsoft
Security Essentials 2.0, Sophos Anti-Virus 4.61.0, NOD32 Antivirus
5795, Avira AntiVir 7.11.1.163, Norman Antivirus 6.06.12, McAfee
Anti-Virus Scanning Engine 5.400.0.1158, Panda Antivirus 10.0.2.7,
McAfee Gateway (formerly Webwasher) 2010.1C, Trend Micro AntiVirus
9.120.0.1004, Comodo Antivirus 7424, Bitdefender 7.2, eSafe 7.0.17.0,
F-Secure Anti-Virus 9.0.16160.0, nProtect Anti-Virus 2011-01-17.01,
AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190,
avast! Antivirus 4.8.1351.0 and 5.0.677.0, and VBA32 3.12.14.2 allows
user-assisted remote attackers to bypass malware detection via a RAR
file with an initial MZ character sequence.  NOTE: this may later be
SPLIT into multiple CVEs if additional information is published
showing that the error occurred independently in different RAR parser
implementations.
Comment 1 Vincent Danen 2012-03-22 21:26:07 UTC 
Created clamav tracking bugs for this issue

Affects: fedora-all [bug 806102]
Affects: epel-all [bug 806103]
Comment 2 Vincent Danen 2012-03-22 21:32:46 UTC 
The upstream bug for this flaw is here:

https://bugzilla.clamav.net/show_bug.cgi?id=4624

Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present.

http://www.openwall.com/lists/oss-security/2012/03/22/1
Comment 3 Fedora Update System 2012-07-11 01:32:30 UTC 
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2012-07-11 01:33:51 UTC 
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.