HTTP: ClamAV UPX File PE parsing Memory Access Error
This signature detects attempts to exploit a known vulnerability against ClamAV UPX File. A successful attack can lead to arbitrary code execution.
Extended Description
Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.
Affected Products
Canonical ubuntu_linux
References
CVE: CVE-2013-2020
Short Name
HTTP:STC:DL:CLAMAV-UPX-FILE-MC
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Access CVE-2013-2020 ClamAV Error File Memory PE UPX parsing
Release Date
06/20/2013
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
False Positive
Unknown
Vendors
Suse
Clamav
Canonical
CVSS Score
5.0