CVE-2005-1795 in ClamAV
Summary
by MITRE
The filecopy function in misc.c in Clam AntiVirus (ClamAV) before 0.85, on Mac OS, allows remote attackers to execute arbitrary code via a virus in a a filename that contains shell metacharacters, which are not properly handled when HFS permissions prevent the file from being deleted and ditto is invoked.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/09/2018
The vulnerability described in CVE-2005-1795 represents a critical security flaw in Clam AntiVirus version 0.84 and earlier, specifically affecting Mac OS systems. This issue stems from improper handling of shell metacharacters within filenames during the filecopy operation, creating a remote code execution vector that could be exploited by malicious actors. The flaw occurs within the misc.c source file, which contains the filecopy function responsible for managing file operations during virus scanning processes.
The technical root cause of this vulnerability lies in the insufficient sanitization of filenames that contain shell metacharacters such as semicolons, ampersands, or backticks. When ClamAV encounters a maliciously crafted filename containing these special characters, the system fails to properly escape or quote these metacharacters during file operations. This improper handling becomes particularly dangerous when HFS (Hierarchical File System) permissions prevent the file from being deleted, causing the system to invoke the ditto command as a fallback mechanism. The ditto command, which is used for copying files and directories on Mac OS, executes with elevated privileges and processes the unsanitized filename directly, leading to arbitrary code execution.
The operational impact of this vulnerability extends beyond simple remote code execution, as it allows attackers to gain unauthorized access to systems running vulnerable versions of ClamAV. Attackers can craft malicious virus files with specially designed filenames containing shell metacharacters, which when scanned by the vulnerable ClamAV software, trigger the exploitation chain. This creates a significant risk for organizations relying on ClamAV for malware detection, as the antivirus software itself becomes a potential attack vector rather than a protective measure. The vulnerability is particularly concerning because it leverages the legitimate system utilities within the operating system, making detection more difficult and the attack more persistent.
This vulnerability maps to CWE-78, which describes improper neutralization of special elements used in shell commands, and aligns with several ATT&CK techniques including T1059.001 for command and scripting interpreter and T1068 for exploit for privilege escalation. The flaw demonstrates a classic case of insufficient input validation and improper output escaping, where the application fails to properly sanitize user-provided data before incorporating it into system commands. Organizations should immediately update to ClamAV version 0.85 or later, which includes proper sanitization of filenames and shell metacharacters. Additional mitigations include implementing network segmentation, monitoring for unusual file operations, and ensuring that antivirus software is run with minimal privileges to limit potential damage from successful exploitation attempts.