[USN-672-1] ClamAV vulnerability
Date: Mon, 17 Nov 2008 15:27:35 -0800
From: Kees Cook <kees@ubuntu.com.>
To: [email protected]
Subject: [USN-672-1] ClamAV vulnerability
Message-ID: <20081117232735.GV11234@outflux.net.>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="DBIVS5p969aUjpLe"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.316 $
X-HELO: www.outflux.net
X-Scanned-By: MIMEDefang 2.63 on 10.2.0.1
X-Virus-Scanned: antivirus-gw at tyumen.ru
--DBIVS5p969aUjpLe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Ubuntu Security Notice USN-672-1 November 17, 2008
clamav vulnerability
CVE-2008-5050
A security issue affects the following Ubuntu releases:
Ubuntu 8.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.10:
libclamav5 0.94.dfsg.1-1ubuntu0.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
Moritz Jodeit discovered that ClamAV did not correctly handle certain
strings when examining a VBA project. If a remote attacker tricked ClamAV
into processing a malicious VBA file, ClamAV would crash, leading to a
denial of service.
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1.diff.gz
Size/MD5: 159057 5725cf706bede729fee19476cc9e2da0
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1.dsc
Size/MD5: 1545 75621bacb9181c1c842b22981898238c
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1.orig.tar.gz
Size/MD5: 21796733 8637ed043ce1408486dbe31a5344cfcf
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-base_0.94.dfsg.1-1ubuntu0.1_all.deb
Size/MD5: 19211410 b7e5c9d9ee4691f4e93054c2ab517a0c
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.94.dfsg.1-1ubuntu0.1_all.deb
Size/MD5: 1074804 bf77b6af599f0c6476aeba4f808433f2
http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-testfiles_0.94.dfsg.1-1ubuntu0.1_all.deb
Size/MD5: 206308 d2ac10476deec6bea5aa5f8628e1066b
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 238464 7330c3a5f0e6d7615c56c22fb3f60cd9
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 912708 3f1a630610744f4d782fa5c6c4f8fb5f
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 254032 b4249de030a3ee71d64700fa7d59bc38
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 234326 8a636c5942b657a566b5d4e5050c0a2f
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 572450 7b04385426af19980c51b428ab314774
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 536116 8e440dd7d4df3db94a1595cfb942f581
http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 231076 f6d9ff56d2dc01bc5c585a5fc269c1a1
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 232060 ade517407bfcf7d4a15bdfa4ae15301d
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 847264 aed581aca9429be3a857a7074b7f4348
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 251774 4b00cbf18c30516c1c2309294f827ea9
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 231404 7bba604ae5afba8c954f9ef6a02638f3
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 540806 f13d6f105fcd6cadac12978fcde8b6aa
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 522518 37c2a34e5165f0f0bc122c3017f31b8e
http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 227676 0ae5263b659a694564a38be262eafd98
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 231546 074471493c489d01d3d63778751e9567
http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 864428 6ac51e226ad6687f9ee9fa356196bf7d
http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 251994 87cf67b1a17b2084a746c5a145fa4905
http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 231002 1379749a34b4ef43155c269e02dbaff0
http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 542558 e25d965122c1e81ecb97b567f88c86c7
http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 524940 26042475abe9e464e402faa6aac190d8
http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 227628 b52e069ee4517c06b95b4b14b95aa59e
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 241772 99a6d9e681de4b13ad3cb60837ca6147
http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 901744 f1d81f00fa0bbf7775bdad0edb2ec4d4
http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 256908 c41e8695f170564262200f7e62a7b957
http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 238986 5b6a5ea03e02bcbbb9fa598bff76c79a
http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 612932 b0e9af13089554bf808c471692191048
http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 553138 c98be80704783e5ec7fcf608d20e1eae
http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 231198 b535583753ffe6cc73f7e4a4f20376ee
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 231630 84ba5b875cb67290c8501ba825199deb
http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 834302 ed63e23fc9ce4073b14302f2553e4dad
http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 251206 f3d18a9ca20dec1a7c5e4046c4fd89f1
http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 231864 5b3aef13761da33bb45e5de6e78fe49c
http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 576800 361eaadd291deefe4c31ed10ba60a4f2
http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 541528 63793c6742c24ea9eae47ba641dd3cf0
http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 228470 7c446c73a80ac31c703a26bed6e1117f
--DBIVS5p969aUjpLe
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Kees Cook <kees@outflux.net.>
iEYEARECAAYFAkkh/ecACgkQH/9LqRcGPm1wVwCfVWrTygxlqmvVPNMX0wLGxjip
DSAAn1z2kRFnkXEU490cfeg+8si4Bd8g
=STSH
-----END PGP SIGNATURE-----
--DBIVS5p969aUjpLe--
