Security News > 2023 > February > Antivirus apps are there to protect you – Cisco's ClamAV has a heckuva flaw

Cisco's open source ClamAV can fill that role - once you patch the 9.8/10 rated arbitrary code execution flaw the networking giant revealed on Wednesday.

"A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code," states Cisco's security advisory, which identifies the issue as CVE-2023-20032.

"An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service condition."

ClamAV's blog reveals a second flaw in the software: CVE-2023-20052.

The Secure Endpoint Private Cloud also needs a fix, as does Cisco's Secure Endpoint product for Linux, Windows, and macOS. Thankfully, Cisco is not aware of "Any public announcements or malicious use of the vulnerability that is described in this advisory."

What with ClamAV being free and open source, these flaws will likely be a target that miscreants and criminals won't ignore for long.

News URL

https://go.theregister.com/feed/www.theregister.com/2023/02/17/cisco_clamav_critical_flaw/