[SOLVED] Clamav Security Alert

[glitch23]

Vulnerability Summary for CVE-2008-1389

Original release date:09/04/2008
Last revised:09/11/2008
Source: US-CERT/NIST
Static Link: National Vulnerability Database (NVD)National Vulnerability Database (CVE-2008-1389)
Overview

libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows disruption of serviceUnknown

National Vulnerability Database (NVD)National Vulnerability Database ()

[mmorse]

This appears to have been addressed in July/August updates:

https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089

Comment #12 From Tomasz Kojm 2008-08-12 11:04:11 [reply] -------
Hi Hanno, the affected module was remotely disabled last month. The fix will be included in 0.94-final (planned on Sept 1, 2008).

clamav: Crash with crafted chm, CVE-2008-1389

2008-07-09: clamav bug opened
unknown date: clamav disables chm-parser through freshclam
2008-09-02 Vendor releases 0.94
2008-09-04 Released this advisory

Bug 31258 - Upgrade to ClamAV 0.94

[glitch23]

Correct, I forgot to add that link in the first post. I just know that we currently use clamav_93.3