Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1419 to the following vulnerability: Name: CVE-2012-1419 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1419 Assigned: 20120229 Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products Reference: http://www.securityfocus.com/archive/1/522005 Reference: http://www.ieee-security.org/TC/SP2012/program.html The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.
Created clamav tracking bugs for this issue Affects: fedora-all [bug 806102] Affects: epel-all [bug 806103]
The upstream bug for this flaw is here: https://bugzilla.clamav.net/show_bug.cgi?id=4623 Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present. http://www.openwall.com/lists/oss-security/2012/03/22/1
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.