Denial of Service Vulnerability in ClamAV: CVE-2018-15378
Summary
ALPINE-CVE-2018-15378: A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. Affects clamav versions < 0.100.2-r0. Fixed in 0.100.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ClamAV is an open-source antivirus engine designed for detecting trojans, viruses, malware, and other malicious threats. It is widely used in various applications and systems to provide security against potential threats. The package is known for its versatility and ability to integrate with other software solutions. However, it has a vulnerability that could lead to a denial of service (DoS) condition, affecting its reliability and performance.
Vulnerability Detail
A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. This vulnerability originates from an error in the MEW unpacker within the 'unmew11()' function (libclamav/mew.c). An attacker can exploit this flaw by crafting a specially designed EXE file that triggers an invalid read memory access, potentially crashing the application and rendering it inoperable.
How To Fix
Minimum fixed version
0.100.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing network-level protections to filter out potentially malicious EXE files before they reach your ClamAV installation. Additionally, avoid processing untrusted files until the update can be applied.
Conclusion
CVE-2018-15378 represents a significant vulnerability in ClamAV that can lead to denial of service conditions. It is crucial for users to update to the patched version (0.100.2 or later) to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for clamav →
FAQ
CVE-2018-15378 is a vulnerability in ClamAV that could allow an attacker to cause a denial of service (DoS) condition due to an error in the MEW unpacker.
This vulnerability can lead to application crashes, making ClamAV unable to perform its intended function of detecting and removing malware.
All versions of ClamAV prior to 0.100.2 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2018-15378 is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
