Bug 580464 (CVE-2010-0098) - CVE-2010-0098 Clam AntiVirus (prior to v0.96): Anti-virus scanning functionality bypass via specially-crafted archive files
Summary: CVE-2010-0098 Clam AntiVirus (prior to v0.96): Anti-virus scanning functional...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-0098
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: https://wwws.clamav.net/bugzilla/show...
Whiteboard:
Depends On: 580676
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-08 10:36 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:36 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-08 20:02:11 UTC
Embargoed:

Attachments (Terms of Use)

Description Jan Lieskovsky 2010-04-08 10:36:44 UTC 
ReversingLabs Corp reported a deficiency in the way Clam AntiVirus
checked / scanned ZIP, CAB, 7Z and RAR archive files for presence
of viruses. Providing a specially-crafted archive file could
allow an attacker to bypass the traditional viruses detection
mechanisms (resulting in archive with malicious content to be
considered as valid).

Upstream bug report:
  [1] https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1826

Upstream patch:
  [2] http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=158c35e81a25ea5fda55a2a7f62ea9fec2e883d9

References:
  [3] http://secunia.com/advisories/39329/

Credit:
  ReversingLabs Corp
Comment 1 Jan Lieskovsky 2010-04-08 10:55:45 UTC 
This issue affects the versions of the clamav package,
as shipped with Fedora release of 11 and 12.

This issue affects the versions of the clamav package,
as present in EPEL-4 and EPEL-5 repositories.

Please fix.
Comment 2 Jan Lieskovsky 2010-04-08 18:41:48 UTC 
Created Fedora tracking bugs for clamav:

All versions: bug #580676
Note You need to log in before you can comment on or make changes to this bug.