Bug 806101 - (CVE-2012-1459) CVE-2012-1459 clamav: specially-crafted length field in tar files evade detection
CVE-2012-1459 clamav: specially-crafted length field in tar files evade detec...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120319,repor...
: Security
Depends On: 806102 806103
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-22 17:23 EDT by Vincent Danen
Modified: 2013-01-29 17:58 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-01-29 17:58:15 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-03-22 17:23:39 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1459 to
the following vulnerability:

Name: CVE-2012-1459
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1459
Assigned: 20120229
Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products
Reference: http://www.securityfocus.com/archive/1/522005
Reference: http://www.ieee-security.org/TC/SP2012/program.html

The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00,
Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus
4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2,
Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus
5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot
Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet
Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3
Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7
AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus
Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher)
2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security
Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12,
nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools
AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus
4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11,
Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall
9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows
remote attackers to bypass malware detection via a TAR archive entry
with a length field corresponding to that entire entry, plus part of
the header of the next entry.  NOTE: this may later be SPLIT into
multiple CVEs if additional information is published showing that the
error occurred independently in different TAR parser implementations.
Comment 1 Vincent Danen 2012-03-22 17:27:57 EDT
Created clamav tracking bugs for this issue

Affects: fedora-all [bug 806102]
Affects: epel-all [bug 806103]
Comment 2 Vincent Danen 2012-03-22 17:34:32 EDT
The upstream bug for this flaw is here:

https://bugzilla.clamav.net/show_bug.cgi?id=4627

Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present.

http://www.openwall.com/lists/oss-security/2012/03/22/1
Comment 3 Fedora Update System 2012-06-22 04:33:42 EDT
clamav-0.97.5-1700.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2012-07-10 16:59:31 EDT
clamav-0.97.5-1600.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2012-07-10 21:32:46 EDT
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-07-10 21:34:05 EDT
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.