INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit which could lead to the execution of arbitrary code. |
| PLATFORM: | Debian GNU/Linux 4.0 (stable) |
| DAMAGE: | Execute arbitrary code. |
| SOLUTION: | Upgrade to the appropriate version. |
| VULNERABILITY ASSESSMENT: |
The risk is MEDIUM. A buffer overflow inthe handler for PeSpin or Upack PE binaries may lead the the execution of arbitrary code. |
| CVSS 2 BASE SCORE: TEMPORAL SCORE: VECTOR: |
6.4 5.3 (AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C) |
| LINKS: | |
| CIAC BULLETIN: | http://www.ciac.org/ciac/bulletins/s-274.shtml |
| ORIGINAL BULLETIN: | http://www.debian.org/security/2008/dsa-1549 |
| CVE: | CVE-2008-0314 CVE-2008-1100 |
[***** Start Debian Security Advisory DSA-1549-1 *****]
Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems:
Damian Put discovered that a buffer overflow in the handler for PeSpin binaries may lead to the execution of arbitrary code.
Alin Rad Pop discovered that a buffer overflow in the handler for Upack PE binaries may lead to the execution of arbitrary code.
Damian Put and Thomas Pollet discovered that a buffer overflow in the handler for WWPack-compressed PE binaries may lead to the execution of arbitrary code.
For the stable distribution (etch) these problems have been fixed in version 0.90.1-3etch11.
For the unstable distribution (sid) these problems have been fixed in version 0.92.1~dfsg2-1.
We recommend that you upgrade your clamav packages.
MD5 checksums of the listed files are available in the original advisory.
[***** End Debian Security Advisory DSA-1549-1 *****]
Voice: +1 925-422-8193 (7 x 24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org