A remote overflow exists in Clam AntiVirus. Clam AntiVirus fails to perform adequate boundary check in libclamav/chmunpack.c, resulting in a heap overflow. With a specially crafted request, an attacker can gain privileges equal to those of the Clam AntiVirus process, possibly allowing for a remote system compromise.

CHM processing contains an integer overflow that results in heap corruption. The following is vulnerable code from read_chunk_entries() in chmunpack.c. If length is -1, it will wrap and malloc() will return small heap buffer which is overflowed on the following strncpy().

name_len = read_enc_int(&current, end);
file_e->name = (unsigned char *) cli_malloc(name_len+1);
if (!file_e->name) {
free(file_e);
return FALSE;
}
strncpy(file_e->name, current, name_len);

Upgrade to version 0.86.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1014567
• Secunia Advisory ID: 16180 16229 16250 16296 16458
• Related OSVDB ID: 18257 18259
• CVE ID: 2005-2450 (see also: NVD)
• Keyword: email integer overflow
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0547.html
• Other Advisory URL: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000987
  http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:125
  http://www.debian.org/security/2005/dsa-776
  http://www.gentoo.org/security/en/glsa/glsa-200507-25.xml
  http://www.rem0te.com/public/images/clamav.pdf
• Vendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?release_id=344514

• Neel Mehta -   -
• Alex Wheeler - advisorieshustlelabs.com - Hustle Labs