Portable Executable
It was discovered that ClamAV did not properly verify its input when
processing TAR archives. A remote attacker could send a specially crafted
TAR file and cause a denial of service via infinite loop.
It was discovered that ClamAV did not properly validate Portable Executable
(PE) files. A remote attacker could send a crafted PE file and cause a
denial of service (divide by zero).
Updated packages for Ubuntu 8.10:
_______________________________________________________________________
Problem Description:
An integer overflow vulnerability was reported by iDefense with clamav
when parsing Portable Executable (PE) files packed in he MEW format.
This could be exploited to cause a heap-based buffer overflow
(CVE-2007-6335).
Toeroek Edwin reported an off-by-one error when decompressing MS-ZIP
compressed CAB files (CVE-2007-6336).
It was discovered that ClamAV did not properly reallocate memory when
processing certain PDF files. A remote attacker could send a specially
crafted PDF and crash ClamAV. (CVE-2010-1639)
An out of bounds memory access flaw was discovered in ClamAV. A remote
attacker could send a specially crafted Portable Executable (PE) file
and crash ClamAV. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-2077)
Updated packages for Ubuntu 9.04:
Description
===========
iDefense reported an integer overflow vulnerability in the cli_scanpe()
function when parsing Portable Executable (PE) files packed in the MEW
format, that could be exploited to cause a heap-based buffer overflow
(CVE-2007-6335). Toeroek Edwin reported an off-by-one error when
decompressing MS-ZIP compressed CAB files (CVE-2007-6336). An
unspecified vulnerability related to the bzip2 decompression algorithm
has also been discovered (CVE-2007-6337).
I. BACKGROUND
Clam AntiVirus is a multi-platform GPL anti-virus toolkit. ClamAV is
often integrated into e-mail gateways and used to scan e-mail traffic
for viruses. It supports virus scanning for a wide variety of packed
Portable Executable (PE) binaries. For more information visit the
vendor's web site at the following URL.
http://www.clamav.net/
II. DESCRIPTION
I. BACKGROUND
Clam AntiVirus is a multi-platform GPL anti-virus toolkit. ClamAV is
often integrated into e-mail gateways and used to scan e-mail traffic
for viruses. It supports virus scanning for a wide variety of packed
Portable Executable (PE) binaries. WWPack is one of the supported
packers. For more information visit the vendor's web site at the
following URL.
http://www.clamav.net/
registered as a System Service and runs at boot time. This service runs
the fval binary located at %SystemDrive%\%ProgramFiles%\Flexvision.
Then, fval will run any file in the
%SystemDrive%\%ProgramFiles%\Flexvision\Plugins directory.
By default, Windows fval has several 32bit Portable Executable (.EXE)
files to provide inventory data to the central console, but most
interesting is the hotfix.exe file, which lists all the installed
HotFixes on the host:
-----------------------------------------------------------------------
The following file formats have been identified as vulnerable:
Adobe Acrobat FrameMaker - .mif
Applix Words - .aw
Microsoft Rich Text Format - .rtf
Portable Executable - .exe
Dynamic Link Library - .dll
Applix Presents - .ag
Microsoft Word - .doc
-- Vendor Response:
http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.4-1_all.deb
* RPM binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4-1.noarch.rpm
* Portable executable for Windows that does not require the Python
interpreter to be installed on the operating system,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.4_exe.zip
Documentation
http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.2-1_all.deb
* RPM binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2-1.noarch.rpm
* Portable executable for Windows that does not require the Python
interpreter to be installed on the operating system,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.2_exe.zip
Documentation
http://downloads.sourceforge.net/sqlmap/sqlmap_0.7-1_all.deb
* RPM binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.7-1.noarch.rpm
* Portable executable for Windows that does not require the Python
interpreter to be installed on the operating system,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.7_exe.zip
Documentation
http://downloads.sourceforge.net/sqlmap/sqlmap_0.6-1_all.deb
* RPM binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6-1.noarch.rpm
* Portable executable for Windows that does not require the Python
interpreter to be installed on the operating system,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6_exe.zip
Note: the subversion repository is not accessible anymore so the only
way to get the new release is to download it from one of the above links.
===========
Multiple vulnerabilities have been found in ClamAV:
* The vendor reported a Divide-by-zero error in the PE ("Portable
Executable"; Windows .exe) file handling of ClamAV (CVE-2008-6680).
* Jeffrey Thomas Peckham found a flaw in libclamav/untar.c, possibly
resulting in an infinite loop when processing TAR archives in clamd
and clamscan (CVE-2009-1270).
* Source zip compressed, http://downloads.sourceforge.net/sqlmap/sqlmap-0.8.zip
* DEB binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap_0.8-1_all.deb
* RPM binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.8-1.noarch.rpm
* Portable executable for Windows that does not require the Python
interpreter to be installed on the operating system,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.8_exe.zip
Documentation
=============
I. BACKGROUND
Clam AntiVirus is a multi-platform anti-virus toolkit released under the
GNU Public License. ClamAV is often integrated into e-mail gateways and
used to scan e-mail messages for viruses. PE, or portable executable,
is the executable file format on Microsoft Windows systems. MEW is one
of the many executable packers that is supported by ClamAV. More
information can be found on the vendor's website at the following URL.
http://www.clamav.net/
http://downloads.sourceforge.net/sqlmap/sqlmap_0.6.1-1_all.deb
* RPM binary package,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1-1.noarch.rpm
* Portable executable for Windows that does not require the Python
interpreter to be installed on the operating system,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.6.1_exe.zip
Documentation
|
