Vulnerabilities > CVE-2008-2713 - Resource Management Errors vulnerability in Clam Anti-Virus Clamav

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.

Vulnerable Configurations

Part Description Count
Application
Clam_Anti-Virus
57

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_CLAMAV-080711.NASL
    descriptionThis update brings clamav to version 0.93.3. It lists CVE-2008-2713 as fixed, but this was fixed in 0.93.1 already, but not mentioned. The update contains stability and bugfixes.
    last seen2020-06-01
    modified2020-06-02
    plugin id39930
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39930
    titleopenSUSE Security Update : clamav (clamav-85)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update clamav-85.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(39930);
      script_version("1.10");
      script_cvs_date("Date: 2019/10/25 13:36:31");
    
      script_cve_id("CVE-2008-2713");
    
      script_name(english:"openSUSE Security Update : clamav (clamav-85)");
      script_summary(english:"Check for the clamav-85 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update brings clamav to version 0.93.3.
    
    It lists CVE-2008-2713 as fixed, but this was fixed in 0.93.1 already,
    but not mentioned. The update contains stability and bugfixes."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=406994"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected clamav packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
      script_cwe_id(399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:clamav");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:clamav-db");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/07/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.0", reference:"clamav-0.93.3-0.1") ) flag++;
    if ( rpm_check(release:"SUSE11.0", reference:"clamav-db-0.93.3-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "clamav");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-6422.NASL
    descriptionBackport upstream fix for CVE-2008-2713 (0.93.1) and fix for incomplete fix of CVE-2008-2713 (0.93.2). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id33537
    published2008-07-18
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33537
    titleFedora 8 : clamav-0.92.1-3.fc8 (2008-6422)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_CLAMAV-5416.NASL
    descriptionThis update brings clamav to version 0.93.3. It lists CVE-2008-2713 as fixed, but this was fixed in 0.93.1 already, but not mentioned. The update contains stability and bugfixes.
    last seen2020-06-01
    modified2020-06-02
    plugin id33503
    published2008-07-15
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33503
    titleSuSE 10 Security Update : clamav (ZYPP Patch Number 5416)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1616.NASL
    descriptionDamian Put discovered a vulnerability in the ClamAV anti-virus toolkit
    last seen2020-06-01
    modified2020-06-02
    plugin id33568
    published2008-07-24
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/33568
    titleDebian DSA-1616-2 : clamav - denial of service
  • NASL familySuSE Local Security Checks
    NASL idSUSE_CLAMAV-5414.NASL
    descriptionThis update brings clamav to version 0.93.3. It lists CVE-2008-2713 as fixed, but this was fixed in 0.93.1 already, but not mentioned. The update contains stability and bugfixes.
    last seen2020-06-01
    modified2020-06-02
    plugin id33502
    published2008-07-15
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33502
    titleopenSUSE 10 Security Update : clamav (clamav-5414)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-166.NASL
    descriptionAn incomplete fix for CVE-2008-2713 resulted in remote attackers being able to cause a denial of service via a malformed Petite file that triggered an out-of-bounds memory access (CVE-2008-3215). This issue is corrected with the 0.93.3 release which is being provided.
    last seen2020-06-01
    modified2020-06-02
    plugin id38014
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/38014
    titleMandriva Linux Security Advisory : clamav (MDVSA-2008:166)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_CLAMAV-5359.NASL
    descriptionClamav was updated to version 0.93.1. It fixes various bugs and one security issue : - libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read. (CVE-2008-2713)
    last seen2020-06-01
    modified2020-06-02
    plugin id33385
    published2008-07-02
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33385
    titleSuSE 10 Security Update : clamav (ZYPP Patch Number 5359)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200808-07.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200808-07 (ClamAV: Multiple Denials of Service) Damian Put has discovered an out-of-bounds memory access while processing Petite files (CVE-2008-2713, CVE-2008-3215). Also, please note that the 0.93 ClamAV branch fixes the first of the two attack vectors of CVE-2007-6595 concerning an insecure creation of temporary files vulnerability. The sigtool attack vector seems still unfixed. Impact : A remote attacker could entice a user or automated system to scan a specially crafted Petite file, possibly resulting in a Denial of Service (daemon crash). Also, the insecure creation of temporary files vulnerability can be triggered by a local user to perform a symlink attack. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id33853
    published2008-08-10
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33853
    titleGLSA-200808-07 : ClamAV: Multiple Denials of Service
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2008-122.NASL
    descriptionA vulnerability was discovered in ClamAV and corrected with the 0.93.1 release : libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read. (CVE-2008-2713) Other bugs have also been corrected in 0.93.1 which is being provided with this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id37440
    published2009-04-23
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/37440
    titleMandriva Linux Security Advisory : clamav (MDVSA-2008:122)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_CLAMAV-5356.NASL
    descriptionThis update brings clamav to version 0.93.1. It fixes various bugs and one security issue : CVE-2008-2713: libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.
    last seen2020-06-01
    modified2020-06-02
    plugin id33384
    published2008-07-02
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33384
    titleopenSUSE 10 Security Update : clamav (clamav-5356)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-5476.NASL
    descriptionThis update fixes : - Bug #451761 - CVE-2008-2713 clamav: DoS / crash via crafted petite file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id33235
    published2008-06-24
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33235
    titleFedora 9 : clamav-0.93.1-1.fc9 (2008-5476)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_CLAMAV-080617.NASL
    descriptionThis update brings clamav to version 0.93.1. It fixes various bugs and one security issue : CVE-2008-2713: libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read.
    last seen2020-06-01
    modified2020-06-02
    plugin id39929
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39929
    titleopenSUSE Security Update : clamav (clamav-44)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2008-006.NASL
    descriptionThe remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-006 applied. This update contains security fixes for a number of programs.
    last seen2020-06-01
    modified2020-06-02
    plugin id34210
    published2008-09-16
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34210
    titleMac OS X Multiple Vulnerabilities (Security Update 2008-006)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2008-6338.NASL
    descriptionUpdate to upstream version 0.93.3, fixing previously incomplete fix for CVE-2008-2713. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id33536
    published2008-07-18
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33536
    titleFedora 9 : clamav-0.93.3-1.fc9 (2008-6338)
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12201.NASL
    descriptionThis update brings clamav to version 0.93.3. It lists CVE-2008-2713 as fixed, but this was fixed in 0.93.1 already, but not mentioned. The update contains stability and bugfixes.
    last seen2020-06-01
    modified2020-06-02
    plugin id41222
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41222
    titleSuSE9 Security Update : clamav (YOU Patch Number 12201)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_5_5.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.5. Mac OS X 10.5.5 contains security fixes for a number of programs.
    last seen2020-06-01
    modified2020-06-02
    plugin id34211
    published2008-09-16
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/34211
    titleMac OS X 10.5.x < 10.5.5 Multiple Vulnerabilities

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 29750 CVE(CAN) ID: CVE-2008-2713 Clam AntiVirus是Unix的GPL杀毒工具包,很多邮件网关产品都在使用。 ClamAV的libclamav/petite.c文件中存在拒绝服务漏洞,如果用户受骗打开了特制的Petite加壳可执行程序的话,就会在以下代码段的memcpy()中触发越界读取,导致拒绝服务的情况: cli_writeint32(curpe+0x24, 0xffffffff); memcpy(pefile+rawbase, buffer+sections[i].raw, sections[i].rsz); rawbase+=PESALIGN(sections[i].rsz, 0x200); curpe+=40; datasize+=PESALIGN(sections[i].vsz, 0x1000); ClamAV &lt; 0.93.1 ClamAV ------ 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&amp;path=/branches/0.93/libclamav/petite.c&amp;rev=3886 target=_blank>http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&amp;path=/branches/0.93/libclamav/petite.c&amp;rev=3886</a>
idSSV:3439
last seen2017-11-19
modified2008-06-20
published2008-06-20
reporterRoot
titleClamAV petite.c无效内存访问绝服务漏洞

References