[uanog] Re: Fwd: clamav 0.65 remote DOS exploit

On Mon, Feb 09, 2004 at 09:06:53PM +0200, Roman Festchook wrote:

Достаточно критично тем кто clamav использует:

Да, clamscan действительно абортится, как и должно быть при наличии того assert(). А вот clamd под линуксом не валится. Очевидно, слёт clamd происходит только под фрей.

---------- Forwarded Message ----------

Subject: clamav 0.65 remote DOS exploit Date: Monday 09 February 2004 16:24 From: Oliver Eikemeier To: bugs@clamav.net Cc: bugtraq@securityfocus.com

...

Description:

It is trivial to crash clamd using a malformed uuencoded message, resulting in a denial of service for all programs (e.g. SMTP daemons) relying on clamd running. The message must only contain one uuencoded line with an illegal line lenght, i.e. starting with a small letter.

libclamav calculates the line lenght of an uuencoded line by taking the ASCII value of the first character minus 64 and does an `assert' if the length is not in the allowed range, effectively terminating the calling program.

=================================================================== uanog mailing list. To Unsubscribe: send mail to majordomo@uanog.kiev.ua with "unsubscribe uanog" in the body of the message