libclamav petite.c denial of sevice issue

[Scott Kitterman]

Binary package hint: clamav

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for clamav.

CVE-2008-2713[0]:
| libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to
| cause a denial of service via a crafted Petite file that triggers an
| out-of-bounds read.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

The DTSA released for this issue seems to have been incomplete. Please
see this mail[1] and the additional upstream commit[2].

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2713
    http://security-tracker.debian.net/tracker/CVE-2008-2713

[1] http://www.openwall.com/lists/oss-security/2008/07/15/1

[2] http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&path=/branches/0.93/libclamav/petite.c&rev=3920

[Michael Rooney (mrooney)]

Hello, what does the Fix Released status indicate, that the fixed version is in Intrepid? Thanks for clarifying!

[Scott Kitterman (kitterman)]

Yes. Here's the patch for Hardy.

[Michael Casadevall (mcasadevall)]

Here's another patch for Gutsy

[Michael Casadevall (mcasadevall)]

Here's the Feisty patch

[Michael Casadevall (mcasadevall)]

and the Dapper patch

[Leonel Nunez (leonelnunez)]

Isn't this a duplicate for : bug 238575?

[Scott Kitterman (kitterman)]

On Thu, 17 Jul 2008 11:33:10 -0000 Leonel Nunez <email address hidden>
wrote:
>Isn't this a duplicate for : bug 238575?

No. That one missed a spot.

[Leonel Nunez (leonelnunez)]

I thought that were the same that's why I didn't get into it

Great it got fixed

[Jamie Strandboge (jdstrand)]

Thanks for the debdiffs! Michael, can you respin the debdiffs so the versions follow https://wiki.ubuntu.com/SecurityUpdateProcedures? Also, the gutsy debdiff needs to have 'gutsy-security'. We also typically have the 'References' field last in the list of changes.

[Scott Kitterman (kitterman)]

We've been following a non-standard sequence for some time. There's no risk
of version collision.

[Michael Casadevall (mcasadevall)]

Replacement gutsy patch at the request of the security team.

[Jamie Strandboge (jdstrand)]

Discussed in IRC-- in reviewing the patches for dapper-gutsy, there were whitespace changes that diverged from Scott's hardy debdiff. Please respin dapper-gutsy by applying hardy's debdiff (minus the changelog). Since all versions have the same source, it's really important to keep the patches the same between all versions. Thanks!

[Michael Casadevall (mcasadevall)]

I'm respinning the fixes (sorry for the late response, I've been running around like an idiot today ;-)).

Here's the gutsy one.

[Michael Casadevall (mcasadevall)]

ack, sorry, I uploaded the wrong debdiff. here's the right one

[Michael Casadevall (mcasadevall)]

Here's feisty

[Michael Casadevall (mcasadevall)]

Here's dapper.

I apologize the invalidness of the patches; I hadn't realized it was all the same version so I simply recreated the patch for each effected version.

[Michael Casadevall (mcasadevall)]

Uploaded the *right* patch this time.

[Launchpad Janitor (janitor)]

This bug was fixed in the package clamav - 0.92.1~dfsg2-1.1ubuntu0.2

---------------
clamav (0.92.1~dfsg2-1.1ubuntu0.2) hardy-security; urgency=high

  * SECURITY UPDATE: fix possible DoS due to invalid memory access
  * References
    CVE-2008-2713
    Debian Bug #490925
  * Updated 27_petite.c.dpatch (LP: #249316)
    - libclamav/petite.c: fix one more spot

 -- Scott Kitterman <email address hidden> Thu, 17 Jul 2008 00:41:21 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package clamav - 0.92.1~dfsg2-1.1~gutsy3.1

---------------
clamav (0.92.1~dfsg2-1.1~gutsy3.1) gutsy-security; urgency=low

  * SECURITY UPDATE: fix possible DoS due to invalid memory access
  * Updated 27_petite.c.dpatch (LP: #249316)
    - libclamav/petite.c: fix one more spot
  * References
    CVE-2008-2713
    Debian Bug #490925

 -- Michael Casadevall <email address hidden> Thu, 17 Jul 2008 05:25:10 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package clamav - 0.92.1~dfsg2-1.1~feisty3.1

---------------
clamav (0.92.1~dfsg2-1.1~feisty3.1) feisty-security; urgency=low

  * SECURITY UPDATE: fix possible DoS due to invalid memory access
  * Updated 27_petite.c.dpatch (LP: #249316)
    - libclamav/petite.c: fix one more spot
  * References
    CVE-2008-2713
    Debian Bug #490925

 -- Michael Casadevall <email address hidden> Thu, 17 Jul 2008 06:03:13 +0000