ClamAV Integer Overflow Vulnerability - CVE-2018-0360
Summary
ALPINE-CVE-2018-0360: ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. Affects clamav versions < 0.100.1-r0. Fixed in 0.100.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting malware and other malicious threats. It is widely used in various applications, including email servers and web gateways, to provide real-time protection against viruses and other threats. The software is known for its flexibility, supporting various file formats and offering a range of scanning options. However, it is vulnerable to a specific issue that can lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2018-0360 is an integer overflow in ClamAV that occurs when processing crafted Hangul Word Processor (HWP) files. This flaw resides in the parsehwp3_paragraph() function within the libclamav/hwp.c file. When an attacker sends a specially crafted HWP file, it can trigger an infinite loop, causing the application to become unresponsive. This could lead to denial of service, impacting the availability of the service that relies on ClamAV for malware detection.
How To Fix
Minimum fixed version
0.100.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the processing of HWP files until the ClamAV package is updated. This can be done by configuring your scanning settings to exclude HWP files from being scanned, thereby mitigating the risk of exploitation.
Conclusion
The ClamAV integer overflow vulnerability (CVE-2018-0360) poses a significant risk to users by potentially leading to denial of service through crafted HWP files. It is crucial to update to the patched version 0.100.1-r0 to ensure the security and availability of your systems. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for clamav →
FAQ
CVE-2018-0360 is a vulnerability in ClamAV that allows an attacker to exploit an integer overflow in the processing of HWP files, potentially leading to a denial of service.
You can check if your installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to an infinite loop in ClamAV, causing the application to hang and resulting in a denial of service for users relying on its scanning capabilities.
Yes, a patch is available in version 0.100.1-r0 of ClamAV. It is recommended to update to this version or later to mitigate the vulnerability.
If you cannot update immediately, consider excluding HWP files from scanning as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
