From: Mandrakelinux Security Team <security@linux-mandrake.com.>
To: [email protected]Subject: MDKSA-2005:025 - Updated clamav packages fix vulnerability
Message-Id: <E1CvjQm-0000il-Fz@updates.mandrakesoft.com.>
Date: Mon, 31 Jan 2005 14:50:00 -0700
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory
_______________________________________________________________________
Package name: clamav
Advisory ID: MDKSA-2005:025
Date: January 31st, 2005
Affected versions: 10.1, Corporate Server 3.0
______________________________________________________________________
Problem Description:
Two problems were discovered in versions of clamav prior to 0.81.
An attacker could evade virus scanning by sending a base64-encoded
imaege file in a URL. Also, by sending a specially-crafted ZIP file,
an attacker could cause a DoS (Denial of Service) by crashing the clamd
daemon.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0133http://secunia.com/advisories/13900/
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.1:
189b039b1be6b299c4a3cdb217004cac 10.1/RPMS/clamav-0.81-0.2.101mdk.i586.rpm
df279d975da9be226b2c85f12a314d26 10.1/RPMS/clamav-db-0.81-0.2.101mdk.i586.rpm
14b2d60a992e4f19bc519586d359879e 10.1/RPMS/clamav-milter-0.81-0.2.101mdk.i586.rpm
0e412074d5631bd9da12834835dc4bd4 10.1/RPMS/libclamav1-0.81-0.2.101mdk.i586.rpm
0a302433e9b82252ef8d7f171011675b 10.1/RPMS/libclamav1-devel-0.81-0.2.101mdk.i586.rpm
d391eb02ba99fb394c07720e1d51fbf9 10.1/SRPMS/clamav-0.81-0.2.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
f593b876f8296c73e3f1cc471618a065 x86_64/10.1/RPMS/clamav-0.81-0.2.101mdk.x86_64.rpm
27552edc9a09215beb56d45a563a1634 x86_64/10.1/RPMS/clamav-db-0.81-0.2.101mdk.x86_64.rpm
0fe14e54d7928531ff93754c67249b9a x86_64/10.1/RPMS/clamav-milter-0.81-0.2.101mdk.x86_64.rpm
0c9abdfcfcc788e25e665c50b7bb98f1 x86_64/10.1/RPMS/lib64clamav1-0.81-0.2.101mdk.x86_64.rpm
016c7bc068f9fec488e67caec9ba7fc0 x86_64/10.1/RPMS/lib64clamav1-devel-0.81-0.2.101mdk.x86_64.rpm
d391eb02ba99fb394c07720e1d51fbf9 x86_64/10.1/SRPMS/clamav-0.81-0.2.101mdk.src.rpm
Corporate Server 3.0:
3018adbd977ac44831886ca21f08ad07 corporate/3.0/RPMS/clamav-0.81-0.2.C30mdk.i586.rpm
761f48bdf52f0b686f31e93c33272741 corporate/3.0/RPMS/clamav-db-0.81-0.2.C30mdk.i586.rpm
f52a9307066a1ff6e2bf6a4ee4b0d5fb corporate/3.0/RPMS/clamav-milter-0.81-0.2.C30mdk.i586.rpm
629ab433037672b5fb5c86b6bf4c0c8f corporate/3.0/RPMS/libclamav1-0.81-0.2.C30mdk.i586.rpm
4ed017363bb603ac5f04cea0a77a12a7 corporate/3.0/RPMS/libclamav1-devel-0.81-0.2.C30mdk.i586.rpm
486ed9bfa906ba9070d1831cf2223fc5 corporate/3.0/SRPMS/clamav-0.81-0.2.C30mdk.src.rpm
Corporate Server 3.0/x86_64:
f4074b7bd6192378af28b4bb406dfec6 x86_64/corporate/3.0/RPMS/clamav-0.81-0.2.C30mdk.x86_64.rpm
62519d5fa81bef3135389f4eb3a7bad7 x86_64/corporate/3.0/RPMS/clamav-db-0.81-0.2.C30mdk.x86_64.rpm
9c4028726f6416351b0153e894c1ff25 x86_64/corporate/3.0/RPMS/clamav-milter-0.81-0.2.C30mdk.x86_64.rpm
280de9bef0989da80adeb4add20882cb x86_64/corporate/3.0/RPMS/lib64clamav1-0.81-0.2.C30mdk.x86_64.rpm
18700db95d1c2732ae1748ac8859151e x86_64/corporate/3.0/RPMS/lib64clamav1-devel-0.81-0.2.C30mdk.x86_64.rpm
486ed9bfa906ba9070d1831cf2223fc5 x86_64/corporate/3.0/SRPMS/clamav-0.81-0.2.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFB/qgImqjQ0CJFipgRAmYpAKC1B1xNyV8tfmFrghoU6OSON/aOCgCfSKOx
BSP2Omauksh6eC5Y1/lS7dc=
=e51Q
-----END PGP SIGNATURE-----
