Bugtraq mailing list archives
Re: iDefense Security Advisory 02.15.07: Multiple Vendor ClamAV MIME Parsing Directory Traversal Vulnerability
From: ohtgend () wylie me uk (Alan J. Wylie)
Date: Thu, 15 Feb 2007 20:04:03 +0000
On Thu, 15 Feb 2007 13:50:59 -0500, iDefense Labs <labs-no-reply () idefense com> said:
Exploitation allows attackers to degrade the service of the ClamAV virus scanning service. The most important mitigating factor is that the clam process runs with the privileges of the clamav user and group.
Clamav may not run in a user/group of its own, and there are several recommendations to run it as the same user as the amavisd-new content filter daemon. For example: http://developer.apple.com/server/virusfiltering.html | Running ClamAV as root is dangerous and leaves my server open to the | risk of intrusion, so instead, we run it as the user amavisd, which | we created in the previous section. and http://www200.pair.com/mecham/spam/clamav-amavisd-new.html has had new instructions regardin AllowSupplementaryGroups added, but the old ones read: | Now open up the clamd.conf file again (mine is /etc/clamav/clamd.conf) | We need to edit this file and change: | User clamav | to | User amavis -- Alan J. Wylie http://www.wylie.me.uk/ "Perfection [in design] is achieved not when there is nothing left to add, but rather when there is nothing left to take away." -- Antoine de Saint-Exupery
Current thread:
- iDefense Security Advisory 02.15.07: Multiple Vendor ClamAV MIME Parsing Directory Traversal Vulnerability iDefense Labs (Feb 15)
- Re: iDefense Security Advisory 02.15.07: Multiple Vendor ClamAV MIME Parsing Directory Traversal Vulnerability Alan J. Wylie (Feb 15)