Clam AntiVirus Bugs Let Remote Users Bypass Malware Detection
SecurityTracker Alert ID: 1026840|
SecurityTracker URL: http://securitytracker.com/id/1026840
CVE-2012-1419, CVE-2012-1443, CVE-2012-1457, CVE-2012-1458, CVE-2012-1459
(Links to External Site)
Date: Mar 23 2012
Modification of system information|
Vendor Confirmed: Yes Exploit Included: Yes |
Version(s): 0.96.4; possibly other versions|
A vulnerability was reported in Clam AntiVirus. A remote user can bypass malware detection.|
A remote user can create a specially crafted POSIX TAR file that will evade detection [CVE-2012-1419].
A remote user can create a specially crafted RAR file to evade detection [CVE-2012-1443].
A remote user can create a specially crafted TAR file to evade detection [CVE-2012-1457].
A remote user can create a specially crafted CHM file to evade detection [CVE-2012-1458].
A remote user can create a specially crafted TAR file to evade detection [CVE-2012-1459].
A remote user can create a file that will bypass malware detection.|
No solution was available at the time of this entry.|
Vendor URL: www.clamav.net/ (Links to External Site)
Access control error|
Linux (Any), UNIX (Any)|
Source Message Contents
Date: Wed, 21 Mar 2012 10:51:48 -0600|
Subject: [oss-security] Vulnerabilities reported in ClamAV 0.96.4
Hopefully security@ for ClamAV goes somewhere useful (I don't feel like
opening a bugzilla account there just to ask this).
Saw a bunch of CVEs come through for various anti-virus products, five
of which are reportedly applicable for ClamAV 0.96.4. I'm wondering a)
if the upstream folks know about these and b) whether or not the report
has a typo in the version, since 0.97.4 is the latest upstream version?
Indicates that CVE-2012-1419, CVE-2012-1443, CVE-2012-1457,
CVE-2012-1458, and CVE-2012-1459 affect ClamAV 0.96.4. There isn't much
more information though. Cutting-n-pasting from the report:
1. Specially crafted infected POSIX TAR files with "[aliases]" as first
9 bytes evades detection. (CVE-2012-1419)
25. Infected RAR files with initial two bytes set to 'MZ' can be fixed
by the user and correctly extracted. Such a file evades detection.
39. If the length field in the header of a file with test EICAR virus
included into a TAR archive is set to be greater than the archive's
total length (1,000,000+original length in our experiments), the
antivirus declares the file to be clean but virus gets extracted
correctly by the GNU tar program. (CVE-2012-1457)
40. A Windows Compiled HTML Help (CHM) file is a set of HTML files,
scripts, and images compressed using the LZX algorithm. For faster
random accesses, the algorithm is reset at intervals instead of
compressing the entire file as a single stream. The length of each
interval is specified in the LZXC header.
If an infected CHM file's header modified so that the reset interval is
lower than in the original file, the antivirus declares the file to be
clean. But the Windows CHM viewer hh.exe correctly decompresses the
infected content located before the tampered header. (CVE-2012-1458)
41. In a POSIX TAR archive, each member file has a 512-byte header
protected by a simple checksum. Every header also contains a file length
field, which is used by the extractor to locate the next header in the
If a TAR archive contains two files: the first one is clean, while the
second is infected with test EICAR virus - and it is modified such that
the length field in the header of the first, clean file to point into
the middle of the header of the second, infected file. The antivirus
declares the file to be clean but virus gets extracted correctly by the
GNU tar program. (CVE-2012-1459)
Vincent Danen / Red Hat Security Response Team