ports/62586: [SECURITY] security/clamav: trivial DOS attack
Oliver Eikemeier
eikemeier at fillmore-labs.com
Mon Feb 9 14:00:35 UTC 2004
>Number: 62586
>Category: ports
>Synopsis: [SECURITY] security/clamav: trivial DOS attack
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Feb 09 06:00:33 PST 2004
>Closed-Date:
>Last-Modified:
>Originator: Oliver Eikemeier
>Release: FreeBSD 4.9-STABLE i386
>Organization:
Fillmore Labs - http://www.fillmore-labs.com
>Environment:
System: FreeBSD nuuk.fillmore-labs.com 4.9-STABLE
>Description:
It is trivial to crash clamd using a malformed uuencoded message, resulting in a
denial of service for all programs (e.g. SMTP daemons) relying on clamd running.
The message must only contain one uuencoded line with an illegal line lenght, i.e.
starting with a small letter.
libclamav calculates the line lenght of an uuencoded line by taking the ASCII value
of the first character minus 64 and does an `assert' if the length is not in the
allowed range, effectively terminating the calling program.
>How-To-Repeat:
Save the following file to ~/clamtest.mbox, removing the leading 'X':
XFrom -
X
Xbegin 644 byebye
Xbyebye
Xend
Then do:
# clamscan --mbox -v ~/clamtest.mbox
assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887
Abort (core dumped)
or
# clamdscan -v ~/clamtest.mbox; ps ax | grep clam
>Fix:
Add the following in files/patch-libclamav::message.c:
--- libclamav/message.c.orig Wed Nov 5 11:59:53 2003
+++ libclamav/message.c Mon Feb 9 13:57:48 2004
@@ -884,7 +884,8 @@
len = *line++ - ' ';
- assert((len >= 0) && (len <= 63));
+ if (len < 0 || len > 63)
+ break;
ptr = decode(line, ptr, uudecode, (len & 3) == 0);
break;
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-ports-bugs
mailing list