Red Hat Bugzilla – Bug 806092
CVE-2012-1419 clamav: specially-crafted POSIX tar files evade detection
Last modified: 2013-01-29 18:05:55 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1419 to
the following vulnerability:
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat
QuickHeal) 11.00 allows remote attackers to bypass malware detection
via a POSIX TAR file with an initial [aliases] character sequence.
NOTE: this may later be SPLIT into multiple CVEs if additional
information is published showing that the error occurred independently
in different TAR parser implementations.
Created clamav tracking bugs for this issue
Affects: fedora-all [bug 806102]
Affects: epel-all [bug 806103]
The upstream bug for this flaw is here:
Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present.
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.