This service will be undergoing maintenance at 00:00 UTC, 2016-09-28. It is expected to last about 1 hours
Bug 427285 - (CVE-2007-6595) CVE-2007-6595 clamav insecure /tmp file use
CVE-2007-6595 clamav insecure /tmp file use
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
http://nvd.nist.gov/nvd.cfm?cvename=C...
: Security
Depends On: 427287 427288 427289
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-02 14:44 EST by Lubomir Kundrak
Modified: 2008-04-25 04:50 EDT (History)
2 users (show)

See Also:
Fixed In Version: clamav-0.92.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-04-25 04:50:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2008-01-02 14:44:18 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6595 to the following vulnerability:

ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files in the cli_gentempfd function in libclamav/others.c or on (2) .ascii files in sigtool, when utf16-decode is enabled.

References:

http://www.securityfocus.com/archive/1/archive/1/485631/100/0/threaded
http://www.securityfocus.com/bid/27064
Comment 2 Lubomir Kundrak 2008-01-08 13:44:50 EST
Ping on this -- Any chance this will get addressed soon?
Comment 3 Lubomir Kundrak 2008-01-08 13:45:26 EST
http://bugs.gentoo.org/show_bug.cgi?id=204340
Comment 5 Tomas Hoger 2008-03-17 14:21:23 EDT
(2) remains unfixed upstream
Comment 6 Tomas Hoger 2008-04-24 14:29:52 EDT
Upstream bug report for this issue:

https://wwws.clamav.net/bugzilla/show_bug.cgi?id=752

Moreover, upstream does not consider vector (2) as security issue:

http://lurker.clamav.net/message/20080102.195717.b4bbdef2.en.html

  Sigtool is primarily a tool for signature database developers and by no
  means it was designed to be run with SUID/SGID bits set. There is no
  practical exploitation of this "vulnerability" and it should not be
  considered a security issue.
Comment 7 Tomas Hoger 2008-04-25 04:50:30 EDT
Issue (1) - more important of the two - was fixed in upstream version 0.92.1.

Isuse (2) is not considered as security issue by upstream, as documented in
comment #6.  It can only be exploited if signature author uses sigtool in world
/ group writable directory.  Moreover, there are probably one or two other
similar issues in sigtool - at least race during *.info file creation seems
possible.

Given the upstream statement, I'm closing this as currentrelease - clamav-0.92.1.

Note You need to log in before you can comment on or make changes to this bug.