Bug 580464 – CVE-2010-0098 Clam AntiVirus (prior to v0.96): Anti-virus scanning functionality bypass via specially-crafted archive files

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 580464 - (CVE-2010-0098) CVE-2010-0098 Clam AntiVirus (prior to v0.96): Anti-virus scanning functionality bypass via specially-crafted archive files

Summary:	CVE-2010-0098 Clam AntiVirus (prior to v0.96): Anti-virus scanning functional...

Status:	CLOSED ERRATA

Aliases:	CVE-2010-0098

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:	https://wwws.clamav.net/bugzilla/show...
Whiteboard:	impact=moderate,source=oss-security,r...
Keywords:	Security

Depends On:	580676
Blocks:
	Show dependency tree / graph

Reported:	2010-04-08 06:36 EDT by Jan Lieskovsky
Modified:	2015-07-31 02:26 EDT (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2013-05-08 16:02:11 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jan Lieskovsky 2010-04-08 06:36:44 EDT

ReversingLabs Corp reported a deficiency in the way Clam AntiVirus
checked / scanned ZIP, CAB, 7Z and RAR archive files for presence
of viruses. Providing a specially-crafted archive file could
allow an attacker to bypass the traditional viruses detection
mechanisms (resulting in archive with malicious content to be
considered as valid).

Upstream bug report:
  [1] https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1826

Upstream patch:
  [2] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=158c35e81a25ea5fda55a2a7f62ea9fec2e883d9

References:
  [3] http://secunia.com/advisories/39329/

Credit:
  ReversingLabs Corp

Comment 1 Jan Lieskovsky 2010-04-08 06:55:45 EDT

This issue affects the versions of the clamav package,
as shipped with Fedora release of 11 and 12.

This issue affects the versions of the clamav package,
as present in EPEL-4 and EPEL-5 repositories.

Please fix.

Comment 2 Jan Lieskovsky 2010-04-08 14:41:48 EDT

Created Fedora tracking bugs for clamav:

All versions: bug #580676

Note You need to log in before you can comment on or make changes to this bug.