Heap Memory Read Vulnerability in ClamAV - CVE-2018-1000085
Summary
ALPINE-CVE-2018-1000085: ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. Affects clamav versions < 0.99.4-r0. Fixed in 0.99.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting malware and other malicious threats. It is widely used in various applications and systems to provide security against viruses, trojans, and other types of malware. The package is known for its versatility and ability to scan files in real-time, making it a popular choice for both personal and enterprise-level security solutions. However, ClamAV version 0.99.3 is vulnerable to a specific issue that can lead to memory leaks and potential exploitation.
Vulnerability Detail
The vulnerability identified as CVE-2018-1000085 is an out-of-bounds heap memory read in the XAR parser, specifically in the function xar_hash_check(). This flaw can lead to the leaking of sensitive memory information, which may assist attackers in developing exploit chains. The vulnerability is triggered when a victim scans a specially crafted XAR file, making it a significant risk for users of the affected ClamAV versions.
How To Fix
Minimum fixed version
0.99.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid scanning XAR files until the package is updated to the patched version. Additionally, implementing file type restrictions in the scanning configuration may help mitigate the risk.
Conclusion
CVE-2018-1000085 represents a significant vulnerability in ClamAV that can lead to memory leaks and potential exploitation through crafted XAR files. Users are strongly advised to update to the patched version 0.99.4-r0 to mitigate this risk. For those unable to update immediately, temporary workarounds are available to reduce exposure.
See every vulnerability recorded for clamav →
FAQ
CVE-2018-1000085 is a vulnerability in ClamAV that allows for an out-of-bounds heap memory read, potentially leading to memory leaks.
ClamAV versions prior to 0.99.4-r0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-1000085 is 5.5, indicating a moderate level of severity.
If immediate updates are not possible, refrain from scanning XAR files and consider implementing file type restrictions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
