Denial of Service Vulnerability in ClamAV AntiVirus Software by Cisco
CVE-2017-12378

5.5MEDIUM

Key Information:

Vendor
Debian
Status
Clamav Antivirus Software Versions 0.99.2 And Prior
Vendor
CVE Published:
26 January 2018

Summary

A vulnerability in ClamAV AntiVirus software versions up to 0.99.2 can be exploited by unauthenticated, remote entities to induce a denial of service condition. This issue arises due to inadequate validation of .tar archive file inputs. When ClamAV processes a malicious .tar file, it may trigger a checksum buffer over-read, resulting in service disruption for the affected device. Immediate updates to patched versions are recommended to mitigate potential risks.

Affected Version(s)

ClamAV AntiVirus software 0.99.2 and prior ClamAV AntiVirus software versions 0.99.2 and prior

References

https://usn.ubuntu.com/3550-1/
vendor-advisoryx_refsource_UBUNTU
https://usn.ubuntu.com/3550-2/
vendor-advisoryx_refsource_UBUNTU
https://bugzilla.clamav.net/show_bug.cgi?id=11946
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.