Security release 0.99.3 available (CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380)

Bug #1745635 reported by Tom on 2018-01-26
306
This bug affects 10 people
Affects Status Importance Assigned to Milestone
clamav (Debian)
Fix Released
Unknown
clamav (Fedora)
Fix Released
Critical
clamav (Suse)
Fix Released
Medium
clamav (Ubuntu)
Undecided
Marc Deslauriers
Precise
Undecided
Leonidas S. Barbosa
Trusty
Undecided
Marc Deslauriers
Xenial
Undecided
Marc Deslauriers
Artful
Undecided
Marc Deslauriers
Bionic
Undecided
Marc Deslauriers

Bug Description

Please upgrade clamav to 0.99.3 in Ubuntu LTS to fix critical security vulnerabilities
http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

CVE-2017-12374
1. ClamAV UAF (use-after-free) Vulnerabilities

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations. If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
https://bugzilla.clamav.net/show_bug.cgi?id=11939

CVE-2017-12375
2. ClamAV Buffer Overflow Vulnerability

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L
https://bugzilla.clamav.net/show_bug.cgi?id=11940

CVE-2017-12376
3. ClamAV Buffer Overflow in handle_pdfname Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.

https://bugzilla.clamav.net/show_bug.cgi?id=11942
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2017-12377
4. ClamAV Mew Packet Heap Overflow Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap overflow condition when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11943
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L /A:L

CVE-2017-12378
5. ClamAV Buffer Over Read Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11946
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L

CVE-2017-12379
6. ClamAV Buffer Overflow in messageAddArgument Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11944
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L /A:L

CVE-2017-12380
7. ClamAV Null Dereference Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation checking mechanisms during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition.

https://bugzilla.clamav.net/show_bug.cgi?id=11945
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Also included are 2 minor fixes to properly detect openssl install locations on FreeBSD 11, and prevent false warnings about zlib 1.2.1# version numbers.

Thank you to the following ClamAV community members for your code
submissions and bug reports!

Alberto Garcia
Daniel J. Luke
Francisco Oca
Sebastian A. Siewior
Suleman Ali

Special thanks to Offensive Research at Salesforce.com for responsible disclosure.

As always you can download the latest copy of ClamAV from our website ClamAV.net/downloads

Please continue the discussion on our mailing lists at http://www.clamav.net/contact#ml

Download full text (6.2 KiB)

http://blog.clamav.net/

ClamAV 0.99.3 has been released!
Join us as we welcome ClamAV 0.99.3 to the family!

As previously mentioned, if you downloaded the beta version of ClamAV 0.99.3, you will need to completely uninstall it and do a fresh install with the production version of 0.99.3 as there are significant code differences.

Also, please ensure that you read our blog post on ClamAV Version Number Adjustments to ensure that you are staying current with our future plans for releases.

This release is a security release and is recommended for all ClamAV users. Please see details below:

CVE-2017-12374
1. ClamAV UAF (use-after-free) Vulnerabilities

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations. If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
https://bugzilla.clamav.net/show_bug.cgi?id=11939

CVE-2017-12375
2. ClamAV Buffer Overflow Vulnerability

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L
https://bugzilla.clamav.net/show_bug.cgi?id=11940

CVE-2017-12376
3. ClamAV Buffer Overflow in handle_pdfname Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.

https://bugzilla.clamav.net/show_bug.cgi?id=11942
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2017-12377
4. ClamAV Mew Packet Heap Overflow Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditio...

Read more...

Description of problem:

Seven CVE's in current clamav (EPEL7 EPEL6) please update urgent to:

ClamAV 0.99.3

Please see:

http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html

Tom (tom1493) wrote :
information type: Private Security → Public Security

This is an autogenerated message for OBS integration:
This bug (1077732) was mentioned in
https://build.opensuse.org/request/show/569980 Factory / clamav

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in clamav (Ubuntu):
status: New → Confirmed
Tom (tom1493) on 2018-01-26
summary: - Fix Jan 2018 security vulnerabilities in CLAMAV
+ Security release 0.99.3 available (CVE-2017-12374 CVE-2017-12375
+ CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379
+ CVE-2017-12380)
Changed in clamav (Debian):
status: Unknown → Confirmed
Changed in clamav (Fedora):
importance: Unknown → Critical
status: Unknown → Confirmed
Changed in clamav (Suse):
importance: Unknown → Medium
status: Unknown → Confirmed

Maintenance updates with ClamAV 0.99.3 have just been released and the packages should appear soon in the repositories.

SUSE-SU-2018:0254-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1049423,1052448,1052449,1052466,1077732
CVE References: CVE-2017-11423,CVE-2017-12374,CVE-2017-12375,CVE-2017-12376,CVE-2017-12377,CVE-2017-12378,CVE-2017-12379,CVE-2017-12380,CVE-2017-6418,CVE-2017-6419,CVE-2017-6420
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src): clamav-0.99.3-0.20.3.2
SUSE Linux Enterprise Server 11-SP3-LTSS (src): clamav-0.99.3-0.20.3.2
SUSE Linux Enterprise Point of Sale 11-SP3 (src): clamav-0.99.3-0.20.3.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src): clamav-0.99.3-0.20.3.2
SUSE Linux Enterprise Debuginfo 11-SP3 (src): clamav-0.99.3-0.20.3.2

SUSE-SU-2018:0255-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1040662,1049423,1052448,1052449,1052466,1077732
CVE References: CVE-2017-11423,CVE-2017-12374,CVE-2017-12375,CVE-2017-12376,CVE-2017-12377,CVE-2017-12378,CVE-2017-12379,CVE-2017-12380,CVE-2017-6418,CVE-2017-6419,CVE-2017-6420
Sources used:
SUSE OpenStack Cloud 6 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server for SAP 12 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server 12-SP3 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server 12-SP2 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Server 12-LTSS (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Desktop 12-SP3 (src): clamav-0.99.3-33.5.1
SUSE Linux Enterprise Desktop 12-SP2 (src): clamav-0.99.3-33.5.1

Changed in clamav (Fedora):
status: Confirmed → Fix Committed
Changed in clamav (Suse):
status: Confirmed → Unknown

openSUSE-SU-2018:0258-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1040662,1049423,1052448,1052449,1052466,1077732
CVE References: CVE-2017-11423,CVE-2017-12374,CVE-2017-12375,CVE-2017-12376,CVE-2017-12377,CVE-2017-12378,CVE-2017-12379,CVE-2017-12380,CVE-2017-6418,CVE-2017-6419,CVE-2017-6420
Sources used:
openSUSE Leap 42.3 (src): clamav-0.99.3-20.1

Changed in clamav (Ubuntu Trusty):
assignee: nobody → Marc Deslauriers (mdeslaur)
Changed in clamav (Ubuntu Xenial):
assignee: nobody → Marc Deslauriers (mdeslaur)
Changed in clamav (Ubuntu Artful):
assignee: nobody → Marc Deslauriers (mdeslaur)
Changed in clamav (Ubuntu Bionic):
assignee: nobody → Marc Deslauriers (mdeslaur)
Changed in clamav (Ubuntu Trusty):
status: New → Confirmed
Changed in clamav (Ubuntu Xenial):
status: New → Confirmed
Changed in clamav (Ubuntu Artful):
status: New → Confirmed
Changed in clamav (Ubuntu Precise):
status: New → Confirmed
assignee: nobody → Leonidas S. Barbosa (leosilvab)

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2018-02-05.
When done, reassign the bug to <email address hidden>.
https://swamp.suse.de/webswamp/wf/63957

Changed in clamav (Debian):
status: Confirmed → Fix Released
Changed in clamav (Fedora):
status: Fix Committed → Fix Released
Changed in clamav (Suse):
status: Unknown → Fix Released
Marc Deslauriers (mdeslaur) wrote :
Changed in clamav (Ubuntu Trusty):
status: Confirmed → Fix Released
Changed in clamav (Ubuntu Xenial):
status: Confirmed → Fix Released
Changed in clamav (Ubuntu Artful):
status: Confirmed → Fix Released
Changed in clamav (Fedora):
status: Fix Released → Fix Committed
Changed in clamav (Ubuntu Precise):
status: Confirmed → Fix Released
Changed in clamav (Ubuntu Bionic):
status: Confirmed → Fix Released
Changed in clamav (Fedora):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.