The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a cabinet (CAB) file with the cffile_FolderOffset field set to 0xff, which causes a zero-length read.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Clamav | Clam_anti-virus | 0.83 (including) | 0.83 (including) |
| Clamav | Clam_anti-virus | 0.84_rc1 (including) | 0.84_rc1 (including) |
| Clamav | Clam_anti-virus | 0.84_rc2 (including) | 0.84_rc2 (including) |
| Clamav | Clam_anti-virus | 0.85 (including) | 0.85 (including) |
| Clamav | Clam_anti-virus | 0.85.1 (including) | 0.85.1 (including) |
| Clamav | Ubuntu | dapper | * |
| Clamav | Ubuntu | devel | * |
| Clamav | Ubuntu | edgy | * |
| Clamav | Ubuntu | feisty | * |
References
- http://www.debian.org/security/2005/dsa-737
- http://www.idefense.com/application/poi/display?id=275\u0026type=vulnerabilities
- http://www.debian.org/security/2005/dsa-737
- http://www.idefense.com/application/poi/display?id=275\u0026type=vulnerabilities