Bug 806094 (CVE-2012-1457) - CVE-2012-1457 clamav: overly long length field in tar files evade detection
Summary: CVE-2012-1457 clamav: overly long length field in tar files evade detection
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-1457
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 806102 806103
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-22 21:06 UTC by Vincent Danen
Modified: 2019-09-29 12:51 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-01-29 23:05:21 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2012-03-22 21:06:32 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1457 to
the following vulnerability:

Name: CVE-2012-1457
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1457
Assigned: 20120229
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
Reference: http://www.securityfocus.com/archive/1/522005
Reference: http://www.ieee-security.org/TC/SP2012/program.html

The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK
2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus
10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00,
ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware
5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus
21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin
Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus
7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee
Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in
Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman
Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus
22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection
11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall
9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows
remote attackers to bypass malware detection via a TAR archive entry
with a length field that exceeds the total TAR file size.  NOTE: this
may later be SPLIT into multiple CVEs if additional information is
published showing that the error occurred independently in different
TAR parser implementations.

Comment 1 Vincent Danen 2012-03-22 21:26:41 UTC
Created clamav tracking bugs for this issue

Affects: fedora-all [bug 806102]
Affects: epel-all [bug 806103]

Comment 2 Vincent Danen 2012-03-22 21:33:16 UTC
The upstream bug for this flaw is here:

https://bugzilla.clamav.net/show_bug.cgi?id=4625

Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present.

http://www.openwall.com/lists/oss-security/2012/03/22/1

Comment 3 Fedora Update System 2012-06-22 08:33:24 UTC
clamav-0.97.5-1700.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2012-07-10 20:59:13 UTC
clamav-0.97.5-1600.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2012-07-11 01:32:20 UTC
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2012-07-11 01:33:43 UTC
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.