FW: [Full-disclosure] Advisory - Clam AntiVirus RAR File HandlingDenial Of Service Vulnerability.

[Randal, Phil]

Right folks,

Here's why we should all upgrade to ClamAV 0.91 right now.

Thanks Jules for so speedily releasing you updated installers.

Phil

-----Original Message-----
From: full-disclosure-bounces at lists.grok.org.uk
[mailto:full-disclosure-bounces at lists.grok.org.uk] On Behalf Of Metaeye
SG
Sent: 11 July 2007 16:13
To: bugtraq at securityfocus.com; full-disclosure at lists.grok.org.uk;
news at securiteam.com
Subject: [Full-disclosure] Advisory - Clam AntiVirus RAR File
HandlingDenial Of Service Vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Vendor
- ------
Clam Antivirus (http://www.clamav.net)

Product
- -------
Clamav (libclamav)

Versions Affected
- -----------------
All before 0.91

Severity
- --------
Moderate

Issue
- -----
Clamav crashes due to processing of standard filters in RAR VM, while
processing a
corrupted RAR file. Processing the corrupted file results in a null
pointer deference.

Impact
- ------
Processing the corrupted file will result in crashing of clamscan
application and
clamd daemon.

Fix
- ---
Upgrade to version 0.91.

PoC
- ---
http://www.metaeye.org/codes/corrupted.rar

Vendor Status
- -------------
Reported: 25/06/2007
Fixed:    11/07/2007


References
- ----------
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=555
http://www.metaeye.org/advisories/54



Metaeye SG // http://www.metaeye.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGlPN/gHlN5ncUR6wRAo1AAJ9dNI51Y4t5BRG3aqIUHPih8cJQ7ACfVrW1
21o5Oadk6A7OVGhdzJph2gk=
=YuBi
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/