Bug 427285 - (CVE-2007-6595) CVE-2007-6595 clamav insecure /tmp file use
CVE-2007-6595 clamav insecure /tmp file use
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 427287 427288 427289
  Show dependency treegraph
Reported: 2008-01-02 14:44 EST by Lubomir Kundrak
Modified: 2008-04-25 04:50 EDT (History)
2 users (show)

See Also:
Fixed In Version: clamav-0.92.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-04-25 04:50:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2008-01-02 14:44:18 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6595 to the following vulnerability:

ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files in the cli_gentempfd function in libclamav/others.c or on (2) .ascii files in sigtool, when utf16-decode is enabled.


Comment 2 Lubomir Kundrak 2008-01-08 13:44:50 EST
Ping on this -- Any chance this will get addressed soon?
Comment 3 Lubomir Kundrak 2008-01-08 13:45:26 EST
Comment 5 Tomas Hoger 2008-03-17 14:21:23 EDT
(2) remains unfixed upstream
Comment 6 Tomas Hoger 2008-04-24 14:29:52 EDT
Upstream bug report for this issue:


Moreover, upstream does not consider vector (2) as security issue:


  Sigtool is primarily a tool for signature database developers and by no
  means it was designed to be run with SUID/SGID bits set. There is no
  practical exploitation of this "vulnerability" and it should not be
  considered a security issue.
Comment 7 Tomas Hoger 2008-04-25 04:50:30 EDT
Issue (1) - more important of the two - was fixed in upstream version 0.92.1.

Isuse (2) is not considered as security issue by upstream, as documented in
comment #6.  It can only be exploited if signature author uses sigtool in world
/ group writable directory.  Moreover, there are probably one or two other
similar issues in sigtool - at least race during *.info file creation seems

Given the upstream statement, I'm closing this as currentrelease - clamav-0.92.1.

Note You need to log in before you can comment on or make changes to this bug.