ClamAV antivirus directory traversal
Published:		15.02.2007
Source:		BUGTRAQ
SecurityVulns ID:		7250
Type:		remote
Level:		8/10
Description:		MIME part id is used to form local filename without checking for ../. In addition, there is a DoS on CAB files parsing.

Affected:		CLAMAV : ClamAV 0.88
CVE:		CVE-2007-0898 (Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.)
		CVE-2007-0897 (Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.)

Original document		IDEFENSE, iDefense Security Advisory 02.15.07: Multiple Vendor ClamAV CAB File Denial of Service Vulnerability (15.02.2007)
		IDEFENSE, iDefense Security Advisory 02.15.07: Multiple Vendor ClamAV MIME Parsing Directory Traversal Vulnerability (15.02.2007)

Discuss:

Read or add your comments to this news (0 comments)