ClamAV® blog: ClamAV 0.10 2.4 security patch released

"Joel Esler (jesler)" <[email protected]> Thu, 16 Jul 2020 19:32:35 +0000
Newsgroups	gmane.comp.security.virus.clamav.announce,gmane.comp.security.virus.clamav.win32,gmane.comp.security.virus.clamav.devel
Message-ID	<[email protected]>
--===============8043212796480408066==
Content-Language: en-US
Content-Type: multipart/signed;
	boundary="Apple-Mail=_ED4EE046-E6D4-43CF-A9F7-1E90539D5D0C";
	protocol="application/pkcs7-signature";
	micalg=sha-256

--Apple-Mail=_ED4EE046-E6D4-43CF-A9F7-1E90539D5D0C
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_9CFD7163-FB1D-4D9F-8CF0-F07C555ABA9A"


--Apple-Mail=_9CFD7163-FB1D-4D9F-8CF0-F07C555ABA9A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


> =
https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html =
<https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html=
>

ClamAV 0.102.4 is out now. Users can head over to clamav.net/downloads =
<https://www.clamav.net/downloads> to download the release materials.

ClamAV 0.102.4 is a bug patch release to address the following issues:

CVE-2020-3350 =
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3350>Fixed a =
vulnerability a malicious user could exploit to replace a scan target's =
directory with a symlink to another path to trick clamscan, clamdscan, =
or clamonacc into removing or moving a different file (such as a =
critical system file). The issue would affect users that use the --move =
or --remove options for clamscan, clamdscan and clamonacc.

For more information about AV quarantine attacks using links, see =
RACK911 Lab's report =
<https://www.rack911labs.com/research/exploiting-almost-every-antivirus-so=
ftware>.

CVE-2020-3327 =
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3327>Fixed a =
vulnerability in the ARJ archive-parsing module in ClamAV 0.102.3 that =
could cause a denial-of-service (DoS) condition. Improper bounds =
checking resulted in an out-of-bounds read that could cause a crash. The =
previous fix for this CVE in version 0.102.3 was incomplete. This fix =
correctly resolves the issue.

CVE-2020-3481 =
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3481>Fixed a =
vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 that =
could cause a denial-of-service (DoS) condition. Improper error handling =
could cause a crash due to a NULL pointer dereference. This =
vulnerability is mitigated for those using the official ClamAV signature =
databases because the file type signatures in daily.cvd will not enable =
the EGG archive parser in affected versions.

We will be publishing a release candidate for version 0.103.0 in the =
next couple of weeks. Stay tuned!

--=20
Joel Esler
Manager, Communities Division
Cisco Talos Intelligence Group
http://www.talosintelligence.com | https://www.snort.org=

--Apple-Mail=_9CFD7163-FB1D-4D9F-8CF0-F07C555ABA9A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base=
 class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass"><br =
class=3D""></div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><a =
href=3D"https://blog.clamav.net/2020/07/clamav-01024-security-patch-releas=
ed.html" =
class=3D"">https://blog.clamav.net/2020/07/clamav-01024-security-patch-rel=
eased.html</a><br class=3D""></blockquote><br class=3D""></div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><div style=3D"caret-color: =
rgb(68, 68, 68); color: rgb(68, 68, 68); font-family: Arial, Tahoma, =
Helvetica, FreeSans, sans-serif; font-size: 13px;" class=3D"">ClamAV =
0.102.4 is out now. Users can head over to&nbsp;<a =
href=3D"https://www.clamav.net/downloads" =
class=3D"">clamav.net/downloads</a>&nbsp;to download the release =
materials.</div><div style=3D"caret-color: rgb(68, 68, 68); color: =
rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D""><br class=3D""></div><div =
style=3D"caret-color: rgb(68, 68, 68); color: rgb(68, 68, 68); =
font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: =
13px;" class=3D"">ClamAV 0.102.4 is a bug patch release to address the =
following issues:</div><div style=3D"caret-color: rgb(68, 68, 68); =
color: rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D""><br class=3D""></div><h3 =
style=3D"margin: 0px; position: relative; caret-color: rgb(68, 68, 68); =
color: rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif;" class=3D""><a =
href=3D"https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3350" =
class=3D"">CVE-2020-3350</a></h3><span style=3D"caret-color: rgb(68, 68, =
68); color: rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, =
FreeSans, sans-serif; font-size: 13px; background-color: rgb(255, 255, =
255);" class=3D"">Fixed a vulnerability a malicious user could exploit =
to replace a scan target's directory with a symlink to another path to =
trick clamscan, clamdscan, or clamonacc into removing or moving a =
different file (such as a critical system file). The issue would affect =
users that use the --move or --remove options for clamscan, clamdscan =
and clamonacc.</span><br style=3D"caret-color: rgb(68, 68, 68); color: =
rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D""><br style=3D"caret-color: =
rgb(68, 68, 68); color: rgb(68, 68, 68); font-family: Arial, Tahoma, =
Helvetica, FreeSans, sans-serif; font-size: 13px;" class=3D""><span =
style=3D"caret-color: rgb(68, 68, 68); color: rgb(68, 68, 68); =
font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: =
13px; background-color: rgb(255, 255, 255);" class=3D"">For more =
information about AV quarantine attacks using links, see&nbsp;</span><a =
href=3D"https://www.rack911labs.com/research/exploiting-almost-every-antiv=
irus-software" class=3D"">RACK911 Lab's report</a><span =
style=3D"caret-color: rgb(68, 68, 68); color: rgb(68, 68, 68); =
font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: =
13px; background-color: rgb(255, 255, 255);" class=3D"">.</span><br =
style=3D"caret-color: rgb(68, 68, 68); color: rgb(68, 68, 68); =
font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: =
13px;" class=3D""><br style=3D"caret-color: rgb(68, 68, 68); color: =
rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D""><h3 style=3D"margin: 0px; =
position: relative; caret-color: rgb(68, 68, 68); color: rgb(68, 68, =
68); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif;" =
class=3D""><a =
href=3D"https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3327" =
class=3D"">CVE-2020-3327</a></h3><span style=3D"caret-color: rgb(68, 68, =
68); color: rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, =
FreeSans, sans-serif; font-size: 13px; background-color: rgb(255, 255, =
255);" class=3D"">Fixed a vulnerability in the ARJ archive-parsing =
module in ClamAV 0.102.3 that could cause a denial-of-service (DoS) =
condition. Improper bounds checking resulted in an out-of-bounds read =
that could cause a crash. The previous fix for this CVE in version =
0.102.3 was incomplete. This fix correctly resolves the issue.</span><br =
style=3D"caret-color: rgb(68, 68, 68); color: rgb(68, 68, 68); =
font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; font-size: =
13px;" class=3D""><br style=3D"caret-color: rgb(68, 68, 68); color: =
rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D""><h3 style=3D"margin: 0px; =
position: relative; caret-color: rgb(68, 68, 68); color: rgb(68, 68, =
68); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif;" =
class=3D""><a =
href=3D"https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3481" =
class=3D"">CVE-2020-3481</a></h3><span style=3D"caret-color: rgb(68, 68, =
68); color: rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, =
FreeSans, sans-serif; font-size: 13px; background-color: rgb(255, 255, =
255);" class=3D"">Fixed a vulnerability in the EGG archive module in =
ClamAV 0.102.0 - 0.102.3 that could cause a denial-of-service (DoS) =
condition. Improper error handling could cause a crash due to a NULL =
pointer dereference. This vulnerability is mitigated for those using the =
official ClamAV signature databases because the file type signatures in =
daily.cvd will not enable the EGG archive parser in affected =
versions.</span><br style=3D"caret-color: rgb(68, 68, 68); color: =
rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D""><div style=3D"caret-color: =
rgb(68, 68, 68); color: rgb(68, 68, 68); font-family: Arial, Tahoma, =
Helvetica, FreeSans, sans-serif; font-size: 13px;" class=3D""><br =
class=3D""></div><div style=3D"caret-color: rgb(68, 68, 68); color: =
rgb(68, 68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, =
sans-serif; font-size: 13px;" class=3D"">We will be publishing a release =
candidate for version 0.103.0 in the next couple of weeks. Stay =
tuned!</div><div style=3D"caret-color: rgb(68, 68, 68); color: rgb(68, =
68, 68); font-family: Arial, Tahoma, Helvetica, FreeSans, sans-serif; =
font-size: 13px;" class=3D""><br class=3D""></div><div class=3D""><div =
class=3D""><font color=3D"#444444" face=3D"Arial, Tahoma, Helvetica, =
FreeSans, sans-serif" size=3D"2" class=3D""><span style=3D"caret-color: =
rgb(68, 68, 68);" class=3D"">--&nbsp;</span></font></div><div =
class=3D""><font color=3D"#444444" face=3D"Arial, Tahoma, Helvetica, =
FreeSans, sans-serif" size=3D"2" class=3D""><span style=3D"caret-color: =
rgb(68, 68, 68);" class=3D"">Joel Esler</span></font></div><div =
class=3D""><font color=3D"#444444" face=3D"Arial, Tahoma, Helvetica, =
FreeSans, sans-serif" size=3D"2" class=3D""><span style=3D"caret-color: =
rgb(68, 68, 68);" class=3D"">Manager, Communities =
Division</span></font></div><div class=3D""><font color=3D"#444444" =
face=3D"Arial, Tahoma, Helvetica, FreeSans, sans-serif" size=3D"2" =
class=3D""><span style=3D"caret-color: rgb(68, 68, 68);" class=3D"">Cisco =
Talos Intelligence Group</span></font></div><div class=3D""><font =
color=3D"#444444" face=3D"Arial, Tahoma, Helvetica, FreeSans, =
sans-serif" size=3D"2" class=3D""><span style=3D"caret-color: rgb(68, =
68, 68);" class=3D""><a href=3D"http://www.talosintelligence.com" =
class=3D"">http://www.talosintelligence.com</a> | <a =
href=3D"https://www.snort.org" =
class=3D"">https://www.snort.org</a></span></font></div></div></div></body=
></html>=

--Apple-Mail=_9CFD7163-FB1D-4D9F-8CF0-F07C555ABA9A--

--Apple-Mail=_ED4EE046-E6D4-43CF-A9F7-1E90539D5D0C
Content-Disposition: attachment; filename="smime.p7s"
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCRYw
ggRuMIIDVqADAgECAgphEIBtAAAAAAAOMA0GCSqGSIb3DQEBBQUAMDUxFjAUBgNVBAoTDUNpc2Nv
IFN5c3RlbXMxGzAZBgNVBAMTEkNpc2NvIFJvb3QgQ0EgMjA0ODAeFw0xNDA0MDQyMDI0MThaFw0y
OTA1MTQyMDI1NDJaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBD
QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMrffhZMUxX7I1bNxrllCgSV5d5MRWeM
DMcG4KsfbV83Knvn7aOtgH8RyPOC6+6fUNnJvz2hL7s8EQc177il2VFO2bD3U6CUgCwskmWtEG+h
hmtfQAqZpVBEGpBNz+ZM+0YGjUjjB9fhrWPX1egnABW/bgeyQ7tlBi999lldmxLFLH2960SwUuHC
/B7tnVn3HZOnqzGmQkI5J9OBYsZULCaM2z0U0KiOFeoopBv+vaw8nk3W1UyvjMv/S58FbA9xgTIk
Ye0Zq77qcbRojLvI9OSLP3dTon4VnnML41d0XoPS6JPGzDSRDAKXndcHk3VUtF+DLAIXqLCQZXfZ
UuTuIncCAwEAAaOCAYcwggGDMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBSflTa0jl3VS8MK
wacpk0NRBv2JUTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwEgYDVR0T
AQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQn88gVHm6aAgkWrSugiWBf2nsvqjBDBgNVHR8EPDA6
MDigNqA0hjJodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY3JsL2NyY2EyMDQ4LmNy
bDBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3Vy
aXR5L3BraS9jZXJ0cy9jcmNhMjA0OC5jZXIwXAYDVR0gBFUwUzBRBgorBgEEAQkVARUAMEMwQQYI
KwYBBQUHAgEWNWh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy9pbmRl
eC5odG1sMA0GCSqGSIb3DQEBBQUAA4IBAQA+Tr4jGkYCjV5r24oCNAtjm+UBPCZdjHCyJOtgXuyK
hGQuG1kVo2ca4Rbj/eBNfUSaIyjS7bb3oh/nRM3tbeqGIVQorGxhvPvIZVAEQIoqi/yfbhie9cU+
paKpHACucaYXu0kyS0pYE5NMNun3Lw3ogOs4XVR5yoVSpKTiVnfTDQchTpwkMgzivqXDcS1OiDfU
8C9WaEZHRWtdUIgl9zoppPGIQa1TflcxhirW4GeH2FOrgaN1d77bIcg6R7RpJ9Xu3/f01nGNunrR
cy993c2meJQoZcOJd15C6ugHwhAxeXY6QXYgkY8KQVCCGwkpshEgbwPrC+I/Itb6P7hGq7awMIIE
oDCCA4igAwIBAgIKAYYRaDD7OEqcKzANBgkqhkiG9w0BAQsFADAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwHhcNMTgxMTIxMDAwMDAwWhcNMjAxMTIwMDAxMDAw
WjCBlTEcMBoGA1UEAxMTSm9lbCBFc2xlciAoamVzbGVyKTEUMBIGA1UECxMLQ2lzY28gVXNlcnMx
EjAQBgNVBAsTCUVtcGxveWVlczETMBEGCgmSJomT8ixkARkTA2NvbTEVMBMGCgmSJomT8ixkARkT
BWNpc2NvMR8wHQYJKoZIhvcNAQkBDBBqZXNsZXJAY2lzY28uY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAjY9Yo3zw0WCxtdtE4oQyXJqoSbeuJULMuLBbZbmalv2w7vNluXG9Qhsh
7zttHIU+z1j0XpG2BnYZMl4AgO23yOyghTAo5u8hBH9Riox9bw0hRkB/pAE89QeZ+1kNOGLuZfN8
B5sTFFmRTztX+TZtIkFONq7q9Wj+h0P5ikvyCgr3tjsbnJRNVSAynEfWGFxIxAGyEYIGMHeSz1ej
SenHps4yI8qTKsX9o3KLRz1nLucUDpm/TCLbQEI87Uv9Phd2v0FptbWUKik9agDjTW4/Q7PjBTPc
OpXem/8w8H9S7TKa248Opt2Nv24oqJZMVAUu6It9oQZWubO0bsYYp8yiDQIDAQABo4IBWDCCAVQw
DgYDVR0PAQH/BAQDAgTwMAwGA1UdEwEB/wQCMAAwegYIKwYBBQUHAQEEbjBsMDwGCCsGAQUFBzAC
hjBodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY2VjYS5jZXIwLAYIKwYB
BQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFJ+VNrSO
XdVLwwrBpymTQ1EG/YlRMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jaXNjb2NlcnRzLmNpc2Nv
LmNvbS9maWxlL2NlY2EuY3JsMBsGA1UdEQQUMBKBEGplc2xlckBjaXNjby5jb20wHQYDVR0OBBYE
FDTmAUtoBuQRY6GKIvCllZGSohm5MB8GA1UdJQQYMBYGCisGAQQBgjcKAwwGCCsGAQUFBwMEMA0G
CSqGSIb3DQEBCwUAA4IBAQA3p6fJ3fQlcqszfVLrike+NXunUtbNejhKDOPMhVc3bsozBPggAZbo
m62BvhsvgVLj/+IS2qIEflQxhS2ToplJi8nXRpZ9Qtsu4mhCByy0Z0Xtaw0v2f78B1pskPxDdXZm
T47sc84h0iW+wuZ4yADZb2azb+2j7GNd/vdPLnVyDE209ksjrYyYNO7LifZqmSqIipBYOyG3JZ25
BMTQP7ttExfRKbrkRFSHapvISiFoBeakwGRSqiF7aTAnilXm0Kp1Aj6cQH0Ju3xgXSUpxQewDvZm
Q+AYG6sV6V0yy4fwa1UQAOVKH0dadXp1z9K5WcrqC8Wqz0ojBLT/Avhfy3sXMYICajCCAmYCAQEw
OjAsMQ4wDAYDVQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhK
nCswDQYJYIZIAWUDBAIBBQCgggEBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN
AQkFMQ8XDTIwMDcxNjE5MzIzNFowLwYJKoZIhvcNAQkEMSIEICDoMcQS55WblEyxFc8JxW7oPYR6
SP6+HD0PSIwvEgAsMEkGCSsGAQQBgjcQBDE8MDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMT
EUNpc2NvIEVtcGxveWVlIENBAgoBhhFoMPs4SpwrMEsGCyqGSIb3DQEJEAILMTygOjAsMQ4wDAYD
VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhKnCswDQYJKoZI
hvcNAQEBBQAEggEAXCC1CFB4j52rhGLNr2xuuvrJL1v2rq0gPAyIkoXKTGM8etr9Ra3H3QQX5zOS
tgKw/wzTlEhLGMIHlhhCtZvDl1cu9hoyAOoALQaDQfJMgsCfvQykD4q+OiJdOpKK5Fn2GeXvmKhT
5r9mhgNGUQuLR9pnXmELYHAqc/RQQJkjBbUFJuNj1Tth/wOcqzZHxPhysiwNPTmLCtcy3Qh986lR
gRzNxh8n/rbvx3uSE3l8x//Iggx/15MIOWqcxxWYkN/yUHxaa+xLjFBhSyqdFOzZGTVKqu6lK3Z1
7ZbowkPiud9q7E4Q9gj0NfNICnSzijPfU+V8/3b9zs2RlMDaVuU5aAAAAAAAAA==

--Apple-Mail=_ED4EE046-E6D4-43CF-A9F7-1E90539D5D0C--

--===============8043212796480408066==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________

clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce

http://www.clamav.net/contact.html#ml

--===============8043212796480408066==--