Critical Buffer Overflow Vulnerability in ClamAV Package
Summary
ALPINE-CVE-2017-12379: ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an af... Affects clamav versions < 0.99.3-r0. Fixed in 0.99.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ClamAV is an open-source antivirus engine designed for detecting malware and viruses on various platforms. It is widely used for email scanning and file scanning to protect systems from malicious threats. The package is known for its flexibility and effectiveness in identifying a wide range of threats. However, versions prior to 0.99.3 are vulnerable to a critical buffer overflow issue that can be exploited by attackers.
Vulnerability Detail
ClamAV AntiVirus software versions 0.99.2 and earlier contain a vulnerability that allows an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. This vulnerability arises from improper input validation in the message parsing function, specifically in the messageAddArgument function within the message.c file. An attacker can exploit this vulnerability by sending a crafted email to the affected device, leading to a buffer overflow condition during the scanning process.
How To Fix
Minimum fixed version
0.99.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling email scanning features until the package can be updated. This can help mitigate the risk of exploitation while you prepare to apply the necessary updates.
Conclusion
The ClamAV package is vulnerable to a critical buffer overflow issue in versions prior to 0.99.3. It is essential to update to the patched version to mitigate the risk of exploitation. Users should also consider using monitoring tools like Vulert to stay informed about vulnerabilities in their software.
See every vulnerability recorded for clamav →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to a denial of service condition or allow an attacker to execute arbitrary code on the affected device.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If you cannot update the package right away, consider disabling email scanning features as a temporary measure to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
