ClamAV Denial of Service Vulnerability - CVE-2017-12376
Summary
ALPINE-CVE-2017-12376: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an af... Affects clamav versions < 0.99.3-r0. Fixed in 0.99.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting trojans, viruses, malware, and other malicious threats. It is widely used in various environments, including email servers and web applications, to provide real-time protection against malware. The vulnerability in question affects versions 0.99.2 and earlier, where improper input validation when handling PDF files can lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12376, arises from ClamAV's failure to properly validate input when processing Portable Document Format (.pdf) files. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted PDF file to an affected device, potentially leading to a denial of service (DoS) condition or even arbitrary code execution. This vulnerability is particularly concerning as it allows attackers to disrupt services or gain unauthorized access to systems.
How To Fix
Minimum fixed version
0.99.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the ClamAV service to trusted networks only, thereby minimizing exposure to potential attacks. Additionally, avoid processing untrusted PDF files until the patch is applied.
Conclusion
CVE-2017-12376 represents a significant security risk for users of ClamAV versions 0.99.2 and earlier. It is crucial to update to the patched version to mitigate the risk of denial of service and potential arbitrary code execution. Users are encouraged to implement workarounds and monitor their systems for any suspicious activity.
See every vulnerability recorded for clamav →
FAQ
CVE-2017-12376 is a vulnerability in ClamAV that allows remote attackers to cause a denial of service or execute arbitrary code by sending crafted PDF files.
Versions 0.99.2 and earlier of ClamAV are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-12376 is 7.8, indicating a high severity level.
If immediate updates are not possible, restrict access to the ClamAV service and avoid processing untrusted PDF files until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
