Clam AntiVirus Vulnerability in ClamD Service Module Allows File Corruption

CVE-2024-20506

Summary

A significant security risk has been identified within the ClamD service module of Clam AntiVirus (ClamAV) which affects various versions including 1.4.0 and earlier. This vulnerability permits an authenticated, local attacker to potentially corrupt critical system files. The flaw arises from the ClamD process's ability to write to its log file while running with elevated privileges without verifying whether the log file has been replaced with a symbolic link. By substituting the ClamD log file with a symlink pointing to a vital system file, an attacker can exploit the vulnerability when the ClamD process is restarted, leading to unauthorized appending of log messages. This could endanger the integrity of essential system files, highlighting the importance of applying recommended security patches and conducting regular system audits.

References