MDVSA-2009:327

Package name
clamav
Date
2009-12-08
Advisory ID
MDVSA-2009:327
Affected versions
2008.0 i586 , 2008.0 x86_64

Problem description

Multiple vulnerabilities has been found and corrected in clamav:

Unspecified vulnerability in ClamAV before 0.95 allows remote
attackers to bypass detection of malware via a modified RAR archive
(CVE-2009-1241).

libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause
a denial of service (crash) via a crafted EXE file that triggers a
divide-by-zero error (CVE-2008-6680).

libclamav/untar.c in ClamAV before 0.95 allows remote attackers to
cause a denial of service (infinite loop) via a crafted file that
causes (1) clamd and (2) clamscan to hang (CVE-2009-1270).

The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1
allows remote attackers to cause a denial of service (application
crash) via a malformed file with UPack encoding (CVE-2009-1371).

Stack-based buffer overflow in the cli_url_canon function in
libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers
to cause a denial of service (application crash) and possibly execute
arbitrary code via a crafted URL (CVE-2009-1372).

Important notice about this upgrade: clamav-0.95+ bundles support
for RAR v3 in libclamav which is a license violation as the RAR v3
license and the GPL license is not compatible. As a consequence to
this Mandriva has been forced to remove the RAR v3 code.

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update provides clamav 0.95.2, which is not vulnerable to these
issues. Additionally klamav-0.46 is being provided that has support
for clamav-0.95+.

Updated packages

2008.0 i586

 d4e8e17141e413c9e87a64b7181627e2  2008.0/i586/clamav-0.95.2-0.1mdv2008.0.i586.rpm
 9179be11ae65a206e3b1c6075836db93  2008.0/i586/clamav-db-0.95.2-0.1mdv2008.0.i586.rpm
 4d3b2e34434bb8ff057205f3575900a4  2008.0/i586/clamav-milter-0.95.2-0.1mdv2008.0.i586.rpm
 377e99d065097abc4b8a7e4817f4f9f1  2008.0/i586/clamd-0.95.2-0.1mdv2008.0.i586.rpm
 253062120fa32d9d42c9058516a72153  2008.0/i586/klamav-0.46-0.1mdv2008.0.i586.rpm
 9ef37702dc560d9941d982cfffeea6af  2008.0/i586/libclamav6-0.95.2-0.1mdv2008.0.i586.rpm
 b9aa169bb1ef5fcad2e59deea2cfbb41  2008.0/i586/libclamav-devel-0.95.2-0.1mdv2008.0.i586.rpm 
 b9a99dc63a69f9b4203fb95bc5d5ff12  2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm
 6a46b5c8bbf5429512e4b1924243526e  2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm

2008.0 x86_64

 4ac8f83b42541e50585c6ee6abd96ba8  2008.0/x86_64/clamav-0.95.2-0.1mdv2008.0.x86_64.rpm
 a1281d397120c7404f05d952dfa117b7  2008.0/x86_64/clamav-db-0.95.2-0.1mdv2008.0.x86_64.rpm
 8c1dc967687df31c29a01a43fcc487ed  2008.0/x86_64/clamav-milter-0.95.2-0.1mdv2008.0.x86_64.rpm
 109b738b88ebb607d2456ea1797d48cd  2008.0/x86_64/clamd-0.95.2-0.1mdv2008.0.x86_64.rpm
 b3dcaa53da6e1413924e2f1f3c611854  2008.0/x86_64/klamav-0.46-0.1mdv2008.0.x86_64.rpm
 2b7975248a809f3cfe9a2c5c7f0719f1  2008.0/x86_64/lib64clamav6-0.95.2-0.1mdv2008.0.x86_64.rpm
 3068f027586ef92661f8a6c60fd6ea3e  2008.0/x86_64/lib64clamav-devel-0.95.2-0.1mdv2008.0.x86_64.rpm 
 b9a99dc63a69f9b4203fb95bc5d5ff12  2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm
 6a46b5c8bbf5429512e4b1924243526e  2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm

References