From: Hanno =?utf-8?q?B=C3=B6ck?= <hanno@hboeck.de.>
To: [email protected]Subject: clamav: Crash with crafted chm, CVE-2008-1389
Date: Thu, 4 Sep 2008 16:03:25 +0200
User-Agent: KMail/1.9.9
Cc: [email protected]
MIME-Version: 1.0
Content-Type: multipart/signed;
boundary="nextPart1700928.7gSh03MQtM";
protocol="application/pgp-signature";
micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <200809041603.26318.hanno@hboeck.de.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
--nextPart1700928.7gSh03MQtM
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
clamav: Crash with crafted chm, CVE-2008-1389
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2008-1389
http://int21.de/cve/CVE-2008-1389-clamav-chd.html
http://www.int21.de/cve/cve-2008-1389-samples.tar.bz2
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=3D1089
Description
A fuzzing test showed weakness in the chm parser of clamav, which can possi=
bly=20
be exploited.
The clamav team has disabled the chm module in older versions though freshc=
lam=20
updates and has released 0.94 with a fixed parser.
The clamav team has not mentioned this issue in the release notes of 0.94,=
=20
which is very bad security behaviour.
Disclosure Timeline
2008-07-09: clamav bug opened
unknown date: clamav disables chm-parser through freshclam
2008-09-02 Vendor releases 0.94
2008-09-04 Released this advisory
CVE Information
The Common Vulnerabilities and Exposures (CVE) project has assigned the nam=
e=20
CVE-2008-1389 to this issue. This is a candidate for inclusion in the CVE=20
list (http://cve.mitre.org/), which standardizes names for security problem=
s.
Credits and copyright
This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosti=
ng.=20
It's licensed under the creative commons attribution license.
Hanno Boeck, 2008-09-04, http://www.hboeck.de
=2D-=20
Hanno B=C3=B6ck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: [email protected]
--nextPart1700928.7gSh03MQtM
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
iEYEABECAAYFAki/6q4ACgkQr2QksT29OyCw2ACeLAZj8BiD2+yRkJSs+X9PMyLl
8+AAnicUkoBy3+y2ChE9Cje4t6lO7lFJ
=Y8AO
-----END PGP SIGNATURE-----
--nextPart1700928.7gSh03MQtM--
