Integer Overflow in ClamAV Hangul Word Processor (HWP) Parsing
Summary
CVE-2018-0360: ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. Affects clamav across 2 version ranges.
< 0.100.1-r0
< dab42eb26e76376341882077ce01449989051a95
Fixed in 0.100.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed to detect malicious software. It is commonly used to scan files and emails for potential threats. The Hangul Word Processor (HWP) is a popular word processing software used primarily in South Korea. ClamAV includes a parser for HWP files to identify any potential malware. However, a vulnerability in the HWP parser allows for an integer overflow, leading to an infinite loop when processing a specially crafted HWP file.
Vulnerability Detail
The vulnerability, identified as CVE-2018-0360, arises from an integer overflow in the parsehwp3_paragraph() function within the libclamav/hwp.c file. By exploiting this flaw, an attacker can create a malicious HWP file that triggers an infinite loop, causing a denial-of-service (DoS) condition. This vulnerability can be exploited remotely by enticing a user to open a crafted HWP file, potentially leading to system instability or unresponsiveness.
How To Fix
Minimum fixed version
0.100.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update ClamAV to the patched version to mitigate the risk of exploitation.
Conclusion
The integer overflow vulnerability in ClamAV's HWP parser can be exploited to cause a denial-of-service condition. To mitigate this risk, users should update their ClamAV installations to version 0.100.1 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clamav →
FAQ
ClamAV is an open-source antivirus engine used to detect and prevent malware infections.
The Hangul Word Processor (HWP) is a popular word processing software primarily used in South Korea.
The vulnerability arises from an integer overflow in the parsehwp3_paragraph() function within the libclamav/hwp.c file.
Exploiting this vulnerability can lead to a denial-of-service (DoS) condition, potentially causing system instability or unresponsiveness.
To protect your system, it is essential to update ClamAV to version 0.100.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
