HTTP: ClamAV libclamav MEW PE File Handling Integer Overflow

A buffer overflow vulnerability exists in the ClamAV AntiVirus product. The vulnerability can be triggered when the application processes crafted PE files. An unauthenticated attacker can exploit this vulnerability by delivering a crafted file to the scanning service resulting in injection and execution of arbitrary code. In a simple attack case aimed at creating a denial of service condition, the affected ClamAV daemon will terminate. This might allow for further exploitation of the target system, exposing the system to other threats in absence of the AntiVirus daemon. In a sophisticated attack scenario where the malicious user is successful in injecting and executing supplied code, the behaviour of the system is dependent on the nature of the injected code. Any code injected into the vulnerable component would execute in the security context of the affected ClamAV daemon.

Extended Description

ClamAV is prone to an integer-overflow vulnerability because it fails to properly verify user-supplied data. Successful exploits of this vulnerability can allow remote attackers to execute arbitrary machine code in the context of applications using the 'libclamav' library. Failed exploits may crash the application. ClamAV 0.91.2 is vulnerable to this issue; other versions may also be affected.

Affected Products

Mandriva corporate_server

References

BugTraq: 26927

CVE: CVE-2007-6335

Short Name

HTTP:STC:DL:CLAMAV-MEW-PACKED

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: ClamAV libclamav MEW PE File Handling Integer Overflow

Extended Description

Affected Products

References

Found a potential security threat?