[NEWS] ClamAV libclamav MEW PE File Integer Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

ClamAV libclamav MEW PE File Integer Overflow Vulnerability
------------------------------------------------------------------------

SUMMARY

<http://www.clamav.net/> Clam AntiVirus is "a multi-platform anti-virus
toolkit released under the GNU Public License. ClamAV is often integrated
into e-mail gateways and used to scan e-mail messages for viruses. PE, or
portable executable, is the executable file format on Microsoft Windows
systems. MEW is one of the many executable packers that is supported by
ClamAV". Remote exploitation of an integer overflow vulnerability in Clam
AntiVirus' ClamAV, as included in various vendors' operating system
distributions, allows attackers to execute arbitrary code with the
privileges of the affected process.

DETAILS

Vulnerable Systems:
* ClamAV version 0.91.2

Immune Systems:
* ClamAV version 0.92

The vulnerability exists within the code responsible for parsing PE files
packed with the MEW packer. During unpacking, two untrusted values are
taken directly from the file without being validated. These values are
later used in an arithmetic operation to calculate the size used to
allocate a heap buffer. This calculation can overflow, resulting in a
buffer of insufficient size being allocated. This later leads to arbitrary
areas of memory being overwritten with attacker supplied data.

Analysis:
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the process using libclamav.

In the case of the clamd program, this will result in code execution with
the privileges of the clamav user. Unsuccessful exploitation results in
the clamd process crashing.

Workaround:
Disabling the scanning of PE files will prevent exploitation. If using
clamscan, this can be done by running clamscan with the '--no-pe' option.
If using clamdscan, set the 'ScanPE' option in the clamd.conf file to
'no'.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5759>
CVE-2007-5759

Disclosure timeline:
10/17/2007 - Initial vendor notification
10/18/2007 - Initial vendor response
12/18/2007 - Coordinated public disclosure

ADDITIONAL INFORMATION

The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=634>

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=634

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.