The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
ClamAV libclamav PeSpin Heap Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.clamav.net/> Clam AntiVirus is "a multi-platform GPL
anti-virus toolkit. ClamAV is often integrated into e-mail gateways and
used to scan e-mail traffic for viruses. It supports virus scanning for a
wide variety of packed Portable Executable (PE) binaries. PeSpin is one of
the supported packer/protectors". Remote exploitation of a heap overflow
vulnerability in Clam AntiVirus' ClamAV, as included in various vendors'
operating system distributions, allows attackers to execute arbitrary code
with the privileges of the affected process.
DETAILS
Vulnerable Systems:
* ClamAV version 0.92.1
Immune Systems:
* ClamAV version 0.92.3
The vulnerability exists within the code responsible for decompressing
sections within a PE binary packed with the PeSpin executable protector.
See the following excerpt from libclamav/spin.c:
417 key32 = cli_readint32(ep+0x2fee);
...
427 cli_dbgmsg("spin: Resources (sect%d) appear to be
compressed\n\tuncompressed offset %x, len %x\n\tcompressed offset %x, len
%x\n", j, sections[j].rva, key32 - sections[j].rva, key32, sections[j].vsz
- (key32 - sections[j].rva));
428
429 if ( (curr=(char *)cli_malloc(sections[j].vsz)) != NULL ) {
430 memcpy(curr, src + sections[j].raw, key32 -
sections[j].rva); /* Uncompressed part */
431 memset(curr + key32 - sections[j].rva, 0, sections[j].vsz -
(key32 - sections[j].rva)); /* bzero */
On line 417, a 32-bit value is read from the file into the "key32"
variable. Then a heap buffer is allocated using the "sections[j].vsz"
value on line 429. The "memcpy" call on line 430 then copies data into the
newly allocated buffer.
No validation is performed on the "key32", "sections[j].raw", and
"sections[j].rva" values before they are used in the memory copy
operation. Since these values are under attacker control, this can lead to
an exploitable heap corruption condition.
Analysis:
Exploitation of this vulnerability results in the execution of arbitrary
code with the privileges of the process using libclamav. In the case of
the clamd program, this will result in code execution with the privileges
of the clamav user. Unsuccessful exploitation results in the clamd process
crashing.
Although it would appear that the following "memset" call will cause a DoS
condition, iDefense Labs confirmed that it is possible to bypass this
call. This is accomplished through manipulating the file such that the
memory layout allows the "sections" structure to be completely controlled
via an overwrite by the "memcpy" call.
Workaround:
Disabling the scanning of PE files will prevent exploitation.
If using clamscan, this can be done by running clamscan with the
'--no-pe' option.
If using clamdscan, set the 'ScanPE' option in the clamd.conf file to
'no'.
Vendor response:
The ClamAV team has addressed this vulnerability within version 0.93.
Additionally, the ClamAV team reports, "the vulnerable module was remotely
disabled via virus-db update in March."
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0314>
CVE-2008-0314
Disclosure timeline:
03/04/2008 - Initial vendor notification
03/06/2008 - Initial vendor response
04/14/2008 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=686>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=686
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
