SourceFire ClamAV 0.97.6 RAR File unrar_iface.c unrar_extract_next_prepare memory corruption

Summaryinfo

A vulnerability was found in SourceFire ClamAV 0.97.6. It has been declared as critical. This impacts the function unrar_extract_next_prepare in the library libclamunrar_iface/unrar_iface.c of the component RAR File Handler. The manipulation results in memory corruption. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as very critical has been found in SourceFire ClamAV 0.97.6 (Anti-Malware Software). Affected is the function unrar_extract_next_prepare in the library libclamunrar_iface/unrar_iface.c of the component RAR File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 03/15/2013 by Felix Groebert, Mateusz Jurczyk and Gynvael Coldwind as Further issue details about flaws corrected in upstream ClamAV 0.97.7 version as not defined mailinglist post (oss-sec). The advisory is shared for download at seclists.org. The public release was coordinated in cooperation with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/10/2019).

Upgrading to version 0.97.7 eliminates this vulnerability. The upgrade is hosted for download at downloads.sourceforge.net. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at OSVDB (91444†) and Secunia (SA52647†). Further details are available at github.com. See VDB-8027 for similar entry. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• SourceFire

Name

• ClamAV

Version

• 0.97.6

License

• free

Website

• Vendor: https://www.cisco.com/c/en/us/services/acquisitions/sourcefire.html

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion