oss-security - Re: CVE request: clamav clamd and clamscan DoS and bypass by malformated archive

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 7 Apr 2009 13:21:40 -0500
From: Jamie Strandboge <jamie@...onical.com>
To: coley@...us.mitre.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: clamav clamd and clamscan DoS and
	bypass by malformated archive

On Tue, 07 Apr 2009, Nico Golde wrote:
> * Thomas Biege <thomas@...e.de> [2009-04-07 15:47]:
> > These two bugs possibly need a CVE-ID.
> > 
> > Here we go:
> > 
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1462
> > 
> > http://blog.zoller.lu/2009/04/clamav-094-and-below-evasion-and-bypass.html
> 
> Should be covered by CVE-2009-1241

The details are scant, but I believe bug #1462[1] to be different from the
unrar issue discussed in the blog and CVE-2009-1241.

Specifically, the patch for 1462 is svn commit r4981 to
libclamav/untar.c to prevent a DoS (infinite loop).

Also, bug 1335[2] is fixed in commit r4980 by a patch to cli_scanpe() in
libclamav/pe.c to prevent a DoS (divide by zero).

AFAICT, the unrar issue (CVE-2009-1241) is covered in Debian bug
#484642[3] and clamav bug #1050[4].

Could we get CVE identifiers for the two remaining issues?

Jamie

[1] https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1462
[2] https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1335
[3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484642
[4] https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1050

-- 
Jamie Strandboge             | http://www.canonical.com

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.