[NEWS] ClamAV Library Multiple Heap Overflows (TNEF, CHM, FSG)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

ClamAV Library Multiple Heap Overflows (TNEF, CHM, FSG)
------------------------------------------------------------------------

SUMMARY

<http://www.clamav.net/> ClamAV is "the most widely used GPL antivirus
library today. It provides file format support for virus analysis". During
the processing of TNEF, CHM, & FSG formats an attacker is able to trigger
several integer overflows that allow attackers to overwrite heap data to
obtain complete control of the system.

DETAILS

Vulnerable Systems:
* ClamAV Version 0.86.1 (current) and prior
* There are numerous implementations of ClamAV listed on their site which
are likely vulnerable. One party to note is Apple. Apple includes ClamAV
by default in Mac OS X Server. In addition, ClamAV has been ported to
windows and a variety of other platforms by third parties who's
implementations are also likely vulnerable. Refer to vendor for specifics.

Immune Systems:
* ClamAV version 0.86.2 fixes some of the issues, specifically, the two
integer overflows in TNEF.

Vulnerable Code:
TNEF processing contains at least two integer overflows that result in a
heap overflows. The following code from tnef_attachment() and
tnef_message() in tnef.c is vulnerable. The length field is an arbitrary
32-bit integer. If length is -1, it will wrap and malloc() will return a
small heap buffer which is overflowed on the following fread().

string = cli_malloc(length + 1);
if(fread(string, 1, length, fp) != length) {
free(string);
return -1;
}

CHM processing contains an integer overflow that results in heap
corruption. The following is vulnerable code from read_chunk_entries() in
chmunpack.c. If length is -1, it will wrap and malloc() will return small
heap buffer which is overflowed on the following strncpy().

name_len = read_enc_int(&current, end);
file_e->name = (unsigned char *) cli_malloc(name_len+1);
if (!file_e->name) {
free(file_e);
return FALSE;
}
strncpy(file_e->name, current, name_len);

FSG processing contains a faulty boundary check that results in a buffer
overflow. The following is vulnerable code from unfsg() in fsg.c.
Specifically, backbytes and backsize are essentially encoded arbitrary
32-bit unsigned integers; and, if both are slightly negative values an
attacker can trigger a heap overflow because of the integer wraps in the
boundary check.

if (cdst-backbytes < dest || cdst+backsize >= dest+dsize)
return -1;
while(backsize--) {
*cdst=*(cdst-backbytes);
cdst++;
}

ADDITIONAL INFORMATION

The original article can be found at:
<http://www.rem0te.com/public/images/clamav.pdf>
http://www.rem0te.com/public/images/clamav.pdf

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.