ClamAV® blog: ClamAV 0.10 1.4 security patch release has been published
"Joel Esler (jesler)" <[email protected]> Wed, 21 Aug 2019 17:02:10 +0000
| Newsgroups | gmane.comp.security.virus.clamav.announce |
|---|---|
| Message-ID | <D1E258ED-2F4D-4AF6-BCB5-C60F53955DED__1586.40932511247$1566406992$gmane$org@cisco.com> |
--===============3010501263448537809==
Content-Language: en-US
Content-Type: multipart/signed;
boundary="Apple-Mail=_980FEF43-B8D7-4ADC-8262-40FD04882051";
protocol="application/pkcs7-signature";
micalg=sha-256
--Apple-Mail=_980FEF43-B8D7-4ADC-8262-40FD04882051
Content-Type: multipart/alternative;
boundary="Apple-Mail=_18A917B2-24A1-4DAA-BD33-FAF214110917"
--Apple-Mail=_18A917B2-24A1-4DAA-BD33-FAF214110917
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=us-ascii
>=20
> =
https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.ht=
ml =
<https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.h=
tml>
>=20
> ClamAV 0.101.4 security patch release has been published
>=20
> Today we have published the ClamAV 0.101.4 security patch release.
>=20
> 0.101.4
>=20
>=20
> ClamAV 0.101.4 is a security patch release that addresses the =
following issues.
> An out of bounds write was possible within ClamAV's NSIS bzip2 =
library when attempting decompression in cases where the number of =
selectors exceeded the max limit set by the library (CVE-2019-12900). =
The issue has been resolved by respecting that limit.
>=20
> Thanks to Martin Simmons for reporting the issue here =
<https://bugzilla.clamav.net/show_bug.cgi?id=3D12371>.
> The zip bomb vulnerability mitigated in 0.101.3 has been assigned the =
CVE identifier CVE-2019-12625. Unfortunately, a workaround for the =
zip-bomb mitigation was immediately identified. To remediate the =
zip-bomb scan time issue, a scan time limit has been introduced in =
0.101.4. This limit now resolves ClamAV's vulnerability to =
CVE-2019-12625.
>=20
> The default scan time limit is 2 minutes (120000 milliseconds).
>=20
> To customize the time limit:
> - use the clamscan --max-scantime option
> - use the clamd MaxScanTime config option
>=20
> Libclamav users may customize the time limit using the =
cl_engine_set_num function. For example:
>=20
> C
> cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, =
time_limit_milliseconds)
>=20
> Thanks to David Fifield for reviewing the zip-bomb mitigation in =
0.101.3 and reporting the issue.
> As usual, ClamAV may be downloaded from =
https://www.clamav.net/downloads <https://www.clamav.net/downloads>, and =
discussion should take place on the ClamAV-Users list =
<https://www.clamav.net/contact#ml>. Thanks!
--Apple-Mail=_18A917B2-24A1-4DAA-BD33-FAF214110917
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=us-ascii
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base=
class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass"><br =
class=3D""></div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><div class=3D""><div =
class=3D"original-url"><br class=3D""><a =
href=3D"https://blog.clamav.net/2019/08/clamav-01014-security-patch-releas=
e-has.html" =
class=3D"">https://blog.clamav.net/2019/08/clamav-01014-security-patch-rel=
ease-has.html</a><br class=3D""><br class=3D""></div><div id=3D"article" =
role=3D"article" style=3D"text-rendering: optimizeLegibility; =
font-family: -apple-system-font; font-size: 1.2em; line-height: 1.5em; =
margin: 0px; padding: 0px;" class=3D"system exported">
<!-- This node will contain a number of div.page. -->
<div class=3D"page" style=3D"word-wrap: break-word; max-width: =
100%;"><h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: =
1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: =
100%;">ClamAV 0.101.4 security patch release has been published</h1>
Today we have published the ClamAV 0.101.4 security patch release.<br =
style=3D"max-width: 100%;" class=3D"">
<br style=3D"max-width: 100%;" class=3D"">
<h3 style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">
0.101.4</h3>
<br style=3D"max-width: 100%;" class=3D"">
ClamAV 0.101.4 is a security patch release that addresses the following =
issues.<br style=3D"max-width: 100%;" class=3D"">
<ul style=3D"max-width: 100%;" class=3D"">
<li style=3D"max-width: 100%;" class=3D""> An out of bounds write =
was possible within ClamAV's NSIS bzip2 library when attempting =
decompression in cases where the number of selectors exceeded the max =
limit set by the library (CVE-2019-12900). The issue has been =
resolved by respecting that limit.<br style=3D"max-width: 100%;" =
class=3D""><br style=3D"max-width: 100%;" class=3D""> Thanks to Martin =
Simmons for reporting the issue <a =
href=3D"https://bugzilla.clamav.net/show_bug.cgi?id=3D12371" =
style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">here</a>.</li>
<li style=3D"max-width: 100%;" class=3D""> The zip bomb =
vulnerability mitigated in 0.101.3 has been assigned the CVE identifier =
CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation =
was immediately identified. To remediate the zip-bomb scan time issue, a =
scan time limit has been introduced in 0.101.4. This limit now resolves =
ClamAV's vulnerability to CVE-2019-12625.<br style=3D"max-width: 100%;" =
class=3D""><br style=3D"max-width: 100%;" class=3D""> The default scan =
time limit is 2 minutes (120000 milliseconds).<br style=3D"max-width: =
100%;" class=3D""><br style=3D"max-width: 100%;" class=3D"">To customize =
the time limit:<br style=3D"max-width: 100%;" class=3D""> - use the =
<span style=3D"max-width: 100%;" class=3D"">clamscan</span> <span =
style=3D"max-width: 100%;" class=3D"">--max-scantime</span> option<br =
style=3D"max-width: 100%;" class=3D"">- use the <span style=3D"max-width: =
100%;" class=3D"">clamd</span> <span style=3D"max-width: 100%;" =
class=3D"">MaxScanTime</span> config option<br style=3D"max-width: =
100%;" class=3D""><br style=3D"max-width: 100%;" class=3D"">Libclamav =
users may customize the time limit using the <span style=3D"max-width: =
100%;" class=3D"">cl_engine_set_num</span> function. For example:<span =
style=3D"max-width: 100%;" class=3D""><br style=3D"max-width: 100%;" =
class=3D""><br style=3D"max-width: 100%;" class=3D"">C<br =
style=3D"max-width: 100%;" class=3D""> =
cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, =
time_limit_milliseconds)</span><br style=3D"max-width: 100%;" =
class=3D""><br style=3D"max-width: 100%;" class=3D"">Thanks to David =
Fifield for reviewing the zip-bomb mitigation in 0.101.3 and reporting =
the issue.</li>
</ul>
<div style=3D"max-width: 100%;" class=3D"">
As usual, ClamAV may be downloaded from <a =
href=3D"https://www.clamav.net/downloads" target=3D"_blank" =
style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">https://www.clamav.net/downloads</a>, and discussion should =
take place on the <a href=3D"https://www.clamav.net/contact#ml" =
target=3D"_blank" style=3D"color: rgb(65, 110, 210); max-width: 100%;" =
class=3D"">ClamAV-Users list</a>. =
Thanks!</div></div></div></div></blockquote></div></body></html>=
--Apple-Mail=_18A917B2-24A1-4DAA-BD33-FAF214110917--
--Apple-Mail=_980FEF43-B8D7-4ADC-8262-40FD04882051
Content-Disposition: attachment; filename="smime.p7s"
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCRYw
ggRuMIIDVqADAgECAgphEIBtAAAAAAAOMA0GCSqGSIb3DQEBBQUAMDUxFjAUBgNVBAoTDUNpc2Nv
IFN5c3RlbXMxGzAZBgNVBAMTEkNpc2NvIFJvb3QgQ0EgMjA0ODAeFw0xNDA0MDQyMDI0MThaFw0y
OTA1MTQyMDI1NDJaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBD
QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMrffhZMUxX7I1bNxrllCgSV5d5MRWeM
DMcG4KsfbV83Knvn7aOtgH8RyPOC6+6fUNnJvz2hL7s8EQc177il2VFO2bD3U6CUgCwskmWtEG+h
hmtfQAqZpVBEGpBNz+ZM+0YGjUjjB9fhrWPX1egnABW/bgeyQ7tlBi999lldmxLFLH2960SwUuHC
/B7tnVn3HZOnqzGmQkI5J9OBYsZULCaM2z0U0KiOFeoopBv+vaw8nk3W1UyvjMv/S58FbA9xgTIk
Ye0Zq77qcbRojLvI9OSLP3dTon4VnnML41d0XoPS6JPGzDSRDAKXndcHk3VUtF+DLAIXqLCQZXfZ
UuTuIncCAwEAAaOCAYcwggGDMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBSflTa0jl3VS8MK
wacpk0NRBv2JUTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwEgYDVR0T
AQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQn88gVHm6aAgkWrSugiWBf2nsvqjBDBgNVHR8EPDA6
MDigNqA0hjJodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY3JsL2NyY2EyMDQ4LmNy
bDBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3Vy
aXR5L3BraS9jZXJ0cy9jcmNhMjA0OC5jZXIwXAYDVR0gBFUwUzBRBgorBgEEAQkVARUAMEMwQQYI
KwYBBQUHAgEWNWh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy9pbmRl
eC5odG1sMA0GCSqGSIb3DQEBBQUAA4IBAQA+Tr4jGkYCjV5r24oCNAtjm+UBPCZdjHCyJOtgXuyK
hGQuG1kVo2ca4Rbj/eBNfUSaIyjS7bb3oh/nRM3tbeqGIVQorGxhvPvIZVAEQIoqi/yfbhie9cU+
paKpHACucaYXu0kyS0pYE5NMNun3Lw3ogOs4XVR5yoVSpKTiVnfTDQchTpwkMgzivqXDcS1OiDfU
8C9WaEZHRWtdUIgl9zoppPGIQa1TflcxhirW4GeH2FOrgaN1d77bIcg6R7RpJ9Xu3/f01nGNunrR
cy993c2meJQoZcOJd15C6ugHwhAxeXY6QXYgkY8KQVCCGwkpshEgbwPrC+I/Itb6P7hGq7awMIIE
oDCCA4igAwIBAgIKAYYRaDD7OEqcKzANBgkqhkiG9w0BAQsFADAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwHhcNMTgxMTIxMDAwMDAwWhcNMjAxMTIwMDAxMDAw
WjCBlTEcMBoGA1UEAxMTSm9lbCBFc2xlciAoamVzbGVyKTEUMBIGA1UECxMLQ2lzY28gVXNlcnMx
EjAQBgNVBAsTCUVtcGxveWVlczETMBEGCgmSJomT8ixkARkTA2NvbTEVMBMGCgmSJomT8ixkARkT
BWNpc2NvMR8wHQYJKoZIhvcNAQkBDBBqZXNsZXJAY2lzY28uY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAjY9Yo3zw0WCxtdtE4oQyXJqoSbeuJULMuLBbZbmalv2w7vNluXG9Qhsh
7zttHIU+z1j0XpG2BnYZMl4AgO23yOyghTAo5u8hBH9Riox9bw0hRkB/pAE89QeZ+1kNOGLuZfN8
B5sTFFmRTztX+TZtIkFONq7q9Wj+h0P5ikvyCgr3tjsbnJRNVSAynEfWGFxIxAGyEYIGMHeSz1ej
SenHps4yI8qTKsX9o3KLRz1nLucUDpm/TCLbQEI87Uv9Phd2v0FptbWUKik9agDjTW4/Q7PjBTPc
OpXem/8w8H9S7TKa248Opt2Nv24oqJZMVAUu6It9oQZWubO0bsYYp8yiDQIDAQABo4IBWDCCAVQw
DgYDVR0PAQH/BAQDAgTwMAwGA1UdEwEB/wQCMAAwegYIKwYBBQUHAQEEbjBsMDwGCCsGAQUFBzAC
hjBodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY2VjYS5jZXIwLAYIKwYB
BQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFJ+VNrSO
XdVLwwrBpymTQ1EG/YlRMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jaXNjb2NlcnRzLmNpc2Nv
LmNvbS9maWxlL2NlY2EuY3JsMBsGA1UdEQQUMBKBEGplc2xlckBjaXNjby5jb20wHQYDVR0OBBYE
FDTmAUtoBuQRY6GKIvCllZGSohm5MB8GA1UdJQQYMBYGCisGAQQBgjcKAwwGCCsGAQUFBwMEMA0G
CSqGSIb3DQEBCwUAA4IBAQA3p6fJ3fQlcqszfVLrike+NXunUtbNejhKDOPMhVc3bsozBPggAZbo
m62BvhsvgVLj/+IS2qIEflQxhS2ToplJi8nXRpZ9Qtsu4mhCByy0Z0Xtaw0v2f78B1pskPxDdXZm
T47sc84h0iW+wuZ4yADZb2azb+2j7GNd/vdPLnVyDE209ksjrYyYNO7LifZqmSqIipBYOyG3JZ25
BMTQP7ttExfRKbrkRFSHapvISiFoBeakwGRSqiF7aTAnilXm0Kp1Aj6cQH0Ju3xgXSUpxQewDvZm
Q+AYG6sV6V0yy4fwa1UQAOVKH0dadXp1z9K5WcrqC8Wqz0ojBLT/Avhfy3sXMYICajCCAmYCAQEw
OjAsMQ4wDAYDVQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhK
nCswDQYJYIZIAWUDBAIBBQCgggEBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN
AQkFMQ8XDTE5MDgyMTE3MDIwNFowLwYJKoZIhvcNAQkEMSIEICQb0WxIXMz1WcYAJtNCEYSU+rDd
A8R26giB7Qu5+SrKMEkGCSsGAQQBgjcQBDE8MDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMT
EUNpc2NvIEVtcGxveWVlIENBAgoBhhFoMPs4SpwrMEsGCyqGSIb3DQEJEAILMTygOjAsMQ4wDAYD
VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhKnCswDQYJKoZI
hvcNAQEBBQAEggEAjAyqaO8gFL8+X8zc5nTRydRKEniBEYzk2ASjmrsOG4QvY6RUxJiOP1nPfIK9
L6z/Y2wmVZVlV681JzmK2txVfT3y/ZTw0kMmXOQq0rZCRHVi5QLaowtjgxJKDRt5ZLrUM9DAwiI8
5In6MISeCrGCZx6670xFLJAxDDtAlrGh7yB1IdUpIFEj8RRK6NnCqR6A0QeBCypIkIyMcCHiTWG/
1LR31T7rPUUx+FGaUcy99uvs1Dzq16KbQGFnFbZNf3W0eYtL/9dtRM7hVXJPIk1Ea0l1x96ao8Ni
FEvhreS+TVpByhq4dv4bVeXz4eRlPdUyU2CPfpBpakEtwtYAn3TADAAAAAAAAA==
--Apple-Mail=_980FEF43-B8D7-4ADC-8262-40FD04882051--
--===============3010501263448537809==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce
http://www.clamav.net/contact.html#ml
--===============3010501263448537809==--