oss-security - clamav CVE ids?

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Wed, 17 Jun 2009 17:22:28 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: clamav CVE ids?

Hi,

Clamav 0.95.2 brings some fixes for Thierry Zollers issues,
which probably deserve (a) CVE id ...

Are there already some assigned?

--- from our bug:
( https://sourceforge.net/project/shownotes.php?release_id=688880&group_id=86638 )

These messages from the ChangeLog could have some security relevance, but I
haven't yet checked the mentioned bug reports:

 * libclamav: detect and handle archives hidden inside other files (eg.
images),
              which can be unpacked by WinZip, WinRAR and other tools (bb#1554)
              Reported by ROGER Mickael and Thierry Zoller

 * libclamav/mspack.c, cab.c: don't rely on file sizes stored in CAB headers
              (bb#1562) Reported by Thierry*Zoller <Thierry*Zoller.lu>

 * libclamunrar/unrarvm.c: fix handling of some broken rar files

 * libclamav/mbox.c: handle malformed emails with embedded \0s (bb #1573)

 * libclamav/readdb.c: add offset checks (bb#1615)

--- 

And also:
http://blog.zoller.lu/2009/05/advisory-clamav-generic-bypass.html
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

http://www.heise.de/newsticker/Update-fuer-freien-Virenscanner-ClamAV-beseitigt-Sehschwaeche--/meldung/140595

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.