[NEWS] Clam AntiVirus Multiple DoS (MS-Expand File Handling, Cabinet File Handling)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Clam AntiVirus Multiple DoS (MS-Expand File Handling, Cabinet File
Handling)
------------------------------------------------------------------------

SUMMARY

<http://www.clamav.net/> Clam AntiVirus is a GPL anti-virus toolkit for
UNIX.

Lack of proper validation by the Clam AntiVirus allows attackers to cause
Clam AntiVirus to enter to infinite loop or exhaust file descriptors pool
and memory.

DETAILS

Vulnerable Systems:
* ClamAV version 0.85 and prior

Immune Systems:
* ClamAV version 0.86

MS-Expand File Handling:
The vulnerability specifically exists due to improper behavior during
exceptional conditions.

Code Snips:
libclamav/scanners.c:
static int cli_scanszdd(...)
{
[...]
FILE *tmp = NULL, *in;

cli_dbgmsg("in cli_scanmscomp()\n");

if((in = fdopen(dup(desc), "rb")) == NULL) {
cli_dbgmsg("SZDD: Can't open descriptor %d\n", desc);
return CL_EMSCOMP;
}

if((tmp = tmpfile()) == NULL) {
cli_dbgmsg("SZDD: Can't generate temporary file.\n");
fclose(in);
return CL_ETMPFILE;
}

if(cli_msexpand(in, tmp) == -1) {
cli_dbgmsg("SZDD: msexpand failed.\n");
return CL_EMSCOMP;
}

[...]
}

Each time the cli_msexpand() function fails , two file descriptors ('in'
and 'tmp') are leaked. As they are both opened using fopen(), there is
also a memory leak (2 * 364 bytes). This allows an attacker to exhaust all
of the available file descriptors fairly quickly with around 1,000
malformed files.

Successful exploitation allows attackers to exhaust file descriptors pool
and memory. Anti-virus detection functionality will fail if there is no
file descriptors available with which to open files. Remote exploitation
can be achieved by sending a malicious file in an e-mail message or during
an HTTP session.

Cabinet File Handling:
The vulnerability specifically exists due to insufficient validation on
cabinet file header data. The ENSURE_BITS() macro fails to check for zero
length reads, allowing a carefully constructed cabinet file to cause an
infinite loop. The ENSURE_BITS() macro is executed indirectly through the
READ_BITS macro and is called from the mszipd_compress function.

Code Snips:
libclamav/mspack/mszipd.c
#define ENSURE_BITS(nbits) do { while (bits_left < (nbits)) { if (i_ptr >= i_end) { if (zipd_read_input(zip)) return zip->error; i_ptr = zip->i_ptr; i_end = zip->i_end; } bit_buffer |= *i_ptr++ << bits_left; bits_left += 8; } } while (0)

#define READ_BITS(val, nbits) do { ENSURE_BITS(nbits); (val) = PEEK_BITS(nbits); REMOVE_BITS(nbits); } while (0)

static int zipd_read_input(struct mszipd_stream *zip) {
int read = zip->sys->read(zip->input, &zip->inbuf[0],
(int)zip->inbuf_size);
if (read < 0) return zip->error = MSPACK_ERR_READ;
zip->i_ptr = &zip->inbuf[0];
zip->i_end = &zip->inbuf[read];

return MSPACK_ERR_OK;
}

int mszipd_decompress(...)
{
[...]
do {
READ_BITS(i, 8);
if (i == 'C') state = 1;
else if ((state == 1) && (i == 'K')) state = 2;
else state = 0;
} while (state != 2);
[...]
}

Modification of the cffile_FolderOffset to 0xff in a CAB file can cause a
read of zero, resulting in the infinite loop.

ClamAV is used in a number of mail gateway products. Successful
exploitation requires an attacker to send a specially constructed CAB file
through a mail gateway or personal anti-virus client utilizing the ClamAV
scanning engine. The infinite loop will cause the ClamAV software to use
all available processor resources, resulting in a denial of service or
severe degradation to system performance. Remote exploitation can be
achieved by sending a malicious file in an e-mail message or during an
HTTP session.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1922>
CAN-2005-1922
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1923>
CAN-2005-1923

Disclosure Timeline:
06/07/2005 - Initial vendor notification
06/08/2005 - Initial vendor response
06/29/2005 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by <mailto:labs-no-reply@idefense.com>
iDEFENSE.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=275&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=275&type=vulnerabilities,

<http://www.idefense.com/application/poi/display?id=276&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=276&type=vulnerabilities

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.