ClamAV Antivirus up to 0.101.1 Scanning Engine PDF File out-of-bounds

Summaryinfo

A vulnerability was found in ClamAV Antivirus up to 0.101.1. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Scanning Engine. The manipulation as part of PDF File leads to out-of-bounds. This vulnerability is listed as CVE-2019-1787. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in ClamAV Antivirus up to 0.101.1 (Anti-Malware Software) and classified as problematic. This issue affects an unknown function of the component Scanning Engine. The manipulation as part of a PDF File leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. The summary by CVE is:

A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device.

The bug was discovered 04/08/2019. The weakness was presented 04/08/2019 (Website). The advisory is shared at security.gentoo.org. The identification of this vulnerability is CVE-2019-1787 since 12/06/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/27/2023).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 197422 (Ubuntu Security Notification for ClamAV Vulnerabilities(USN-3940-1)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-133132, VDB-133134, VDB-133131 and VDB-133135 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Anti-Malware Software

Vendor

• ClamAV

Name

• Antivirus

Version

• 0.101.0
• 0.101.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion