ClamAV up to 1.2.1 ClamD Service command injection

Summaryinfo

A vulnerability classified as critical was found in ClamAV 0.104/0.105/1.0.4/1.1/1.2.1. Affected by this vulnerability is an unknown functionality of the component ClamD Service. The manipulation results in command injection. This vulnerability is identified as CVE-2024-20328. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ClamAV 0.104/0.105/1.0.4/1.1/1.2.1 (Anti-Malware Software). It has been classified as critical. Affected is an unknown function of the component ClamD Service. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

The weakness was released 02/08/2024. The advisory is shared for download at blog.clamav.net. This vulnerability is traded as CVE-2024-20328 since 11/08/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 1.0.5, 1.2.2 or 1.3.0 eliminates this vulnerability. The upgrade is hosted for download at blog.clamav.net.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Anti-Malware Software

Name

• ClamAV

Version

• 0.104
• 0.105
• 1.0.4
• 1.1
• 1.2.1

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion