Stack-buffer-overflow in parse_regex in ClamAV
Summary
OSV-2023-648: Stack-buffer-overflow in parse_regex. Affects clamav versions >= 1c6746853f6c40407dc8a801c544e0d72313fc0f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting malicious software. It is widely used to scan files and emails for potential threats. The vulnerability in question affects the parse_regex function within ClamAV, which is responsible for parsing regular expressions. This vulnerability can lead to a stack-buffer-overflow, potentially allowing an attacker to execute arbitrary code or crash the application.
Vulnerability Detail
The stack-buffer-overflow vulnerability in parse_regex has been identified and reported through the OSS-Fuzz project. The vulnerability occurs when reading data from a stack buffer without proper bounds checking. An attacker could exploit this issue by crafting a malicious regular expression that triggers the overflow, leading to potential code execution or denial of service. The vulnerability has a medium severity rating.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can consider disabling the use of regular expressions in ClamAV until the vulnerability is patched. This can be achieved by modifying the configuration settings to exclude regular expression scanning. However, this workaround may limit the effectiveness of ClamAV in detecting certain types of threats that rely on regular expressions.
Conclusion
In conclusion, the stack-buffer-overflow vulnerability in parse_regex within ClamAV poses a potential security risk. It is crucial to update ClamAV to a patched version or consider implementing the provided workaround to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clamav →
FAQ
ClamAV is an open-source antivirus engine used for detecting malicious software.
The vulnerability can potentially allow an attacker to execute arbitrary code or crash the application.
To fix this vulnerability, update ClamAV to a version that includes the patch for this issue.
Yes, users can temporarily disable regular expression scanning in ClamAV as a workaround.
You can find more information about this vulnerability in the ClamAV repository and the provided OSS-Fuzz report.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
