Buffer overflow in ClamAV - CVE-2017-12379

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10317

Buffer overflow in ClamAV - CVE-2017-12379

Published: January 29, 2018


Vulnerability identifier: #VU10317
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12379
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists due to input validation checking mechanisms in the message parsing function. A remote attacker can send a specially crafted email, trigger a messageAddArgument (in message.c) buffer overflow condition and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

ClamAV
Gentoo Linux
Arch Linux
Amazon Linux AMI
Fedora
SUSE Linux
Ubuntu
Opensuse
clamav (Alpine package)
clamav

How to mitigate CVE-2017-12379

Update to version 0.99.3.

clamav (Alpine package) - update to 0.100.1-r0
clamav - addressed in versions 0.99.3-1.el7, 0.99.3-1.fc26, 0.99.3-1.fc27, 0.99.3-8.el6

External References

Related Security Bulletins