Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1458 to the following vulnerability: Name: CVE-2012-1458 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1458 Assigned: 20120229 Reference: BUGTRAQ:20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products Reference: http://www.securityfocus.com/archive/1/522005 Reference: http://www.ieee-security.org/TC/SP2012/program.html The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations.
Created clamav tracking bugs for this issue Affects: fedora-all [bug 806102] Affects: epel-all [bug 806103]
The upstream bug for this flaw is here: https://bugzilla.clamav.net/show_bug.cgi?id=4626 Upstream has no further information as of yet; the report indicates the flaw is in 0.96.4, but the current upstream version is 0.97.4, so it's unknown whether these flaws are still present. http://www.openwall.com/lists/oss-security/2012/03/22/1
clamav-0.97.5-1700.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1600.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
clamav-0.97.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.