-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:327 http://www.mandriva.com/security/ _______________________________________________________________________ Package : clamav Date : December 8, 2009 Affected: 2008.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in clamav: Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive (CVE-2009-1241). libclamav/pe.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (crash) via a crafted EXE file that triggers a divide-by-zero error (CVE-2008-6680). libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted file that causes (1) clamd and (2) clamscan to hang (CVE-2009-1270). The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding (CVE-2009-1371). Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL (CVE-2009-1372). Important notice about this upgrade: clamav-0.95+ bundles support for RAR v3 in libclamav which is a license violation as the RAR v3 license and the GPL license is not compatible. As a consequence to this Mandriva has been forced to remove the RAR v3 code. Packages for 2008.0 are being provided due to extended support for Corporate products. This update provides clamav 0.95.2, which is not vulnerable to these issues. Additionally klamav-0.46 is being provided that has support for clamav-0.95+. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6680 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1241 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1270 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1371 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1372 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: d4e8e17141e413c9e87a64b7181627e2 2008.0/i586/clamav-0.95.2-0.1mdv2008.0.i586.rpm 9179be11ae65a206e3b1c6075836db93 2008.0/i586/clamav-db-0.95.2-0.1mdv2008.0.i586.rpm 4d3b2e34434bb8ff057205f3575900a4 2008.0/i586/clamav-milter-0.95.2-0.1mdv2008.0.i586.rpm 377e99d065097abc4b8a7e4817f4f9f1 2008.0/i586/clamd-0.95.2-0.1mdv2008.0.i586.rpm 253062120fa32d9d42c9058516a72153 2008.0/i586/klamav-0.46-0.1mdv2008.0.i586.rpm 9ef37702dc560d9941d982cfffeea6af 2008.0/i586/libclamav6-0.95.2-0.1mdv2008.0.i586.rpm b9aa169bb1ef5fcad2e59deea2cfbb41 2008.0/i586/libclamav-devel-0.95.2-0.1mdv2008.0.i586.rpm b9a99dc63a69f9b4203fb95bc5d5ff12 2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm 6a46b5c8bbf5429512e4b1924243526e 2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 4ac8f83b42541e50585c6ee6abd96ba8 2008.0/x86_64/clamav-0.95.2-0.1mdv2008.0.x86_64.rpm a1281d397120c7404f05d952dfa117b7 2008.0/x86_64/clamav-db-0.95.2-0.1mdv2008.0.x86_64.rpm 8c1dc967687df31c29a01a43fcc487ed 2008.0/x86_64/clamav-milter-0.95.2-0.1mdv2008.0.x86_64.rpm 109b738b88ebb607d2456ea1797d48cd 2008.0/x86_64/clamd-0.95.2-0.1mdv2008.0.x86_64.rpm b3dcaa53da6e1413924e2f1f3c611854 2008.0/x86_64/klamav-0.46-0.1mdv2008.0.x86_64.rpm 2b7975248a809f3cfe9a2c5c7f0719f1 2008.0/x86_64/lib64clamav6-0.95.2-0.1mdv2008.0.x86_64.rpm 3068f027586ef92661f8a6c60fd6ea3e 2008.0/x86_64/lib64clamav-devel-0.95.2-0.1mdv2008.0.x86_64.rpm b9a99dc63a69f9b4203fb95bc5d5ff12 2008.0/SRPMS/clamav-0.95.2-0.1mdv2008.0.src.rpm 6a46b5c8bbf5429512e4b1924243526e 2008.0/SRPMS/klamav-0.46-0.1mdv2008.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLHlb7mqjQ0CJFipgRArB7AJ96vycVt/sc1YDwjmFkzl20gzfsRQCgsJEp 0vt39CYEd6o0ENF/6xMWYis= =VxRu -----END PGP SIGNATURE-----
