USN-672-1: ClamAV vulnerability

Posted by Bob on: 11/18/2008 12:30 AM [ Print | 0 comment(s) ]

A new ClamAV vulnerability update is available for Ubuntu Linux. Here the announcement:

Ubuntu Security Notice USN-672-1 November 17, 2008
clamav vulnerability
CVE-2008-5050
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
libclamav5 0.94.dfsg.1-1ubuntu0.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Moritz Jodeit discovered that ClamAV did not correctly handle certain
strings when examining a VBA project. If a remote attacker tricked ClamAV
into processing a malicious VBA file, ClamAV would crash, leading to a
denial of service.

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1.diff.gz
Size/MD5: 159057 5725cf706bede729fee19476cc9e2da0
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1.dsc
Size/MD5: 1545 75621bacb9181c1c842b22981898238c
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1.orig.tar.gz
Size/MD5: 21796733 8637ed043ce1408486dbe31a5344cfcf

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-base_0.94.dfsg.1-1ubuntu0.1_all.deb
Size/MD5: 19211410 b7e5c9d9ee4691f4e93054c2ab517a0c
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-docs_0.94.dfsg.1-1ubuntu0.1_all.deb
Size/MD5: 1074804 bf77b6af599f0c6476aeba4f808433f2
http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-testfiles_0.94.dfsg.1-1ubuntu0.1_all.deb
Size/MD5: 206308 d2ac10476deec6bea5aa5f8628e1066b

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 238464 7330c3a5f0e6d7615c56c22fb3f60cd9
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 912708 3f1a630610744f4d782fa5c6c4f8fb5f
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 254032 b4249de030a3ee71d64700fa7d59bc38
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 234326 8a636c5942b657a566b5d4e5050c0a2f
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 572450 7b04385426af19980c51b428ab314774
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 536116 8e440dd7d4df3db94a1595cfb942f581
http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_amd64.deb
Size/MD5: 231076 f6d9ff56d2dc01bc5c585a5fc269c1a1

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 232060 ade517407bfcf7d4a15bdfa4ae15301d
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 847264 aed581aca9429be3a857a7074b7f4348
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 251774 4b00cbf18c30516c1c2309294f827ea9
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 231404 7bba604ae5afba8c954f9ef6a02638f3
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 540806 f13d6f105fcd6cadac12978fcde8b6aa
http://security.ubuntu.com/ubuntu/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 522518 37c2a34e5165f0f0bc122c3017f31b8e
http://security.ubuntu.com/ubuntu/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_i386.deb
Size/MD5: 227676 0ae5263b659a694564a38be262eafd98

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 231546 074471493c489d01d3d63778751e9567
http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 864428 6ac51e226ad6687f9ee9fa356196bf7d
http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 251994 87cf67b1a17b2084a746c5a145fa4905
http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 231002 1379749a34b4ef43155c269e02dbaff0
http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 542558 e25d965122c1e81ecb97b567f88c86c7
http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 524940 26042475abe9e464e402faa6aac190d8
http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_lpia.deb
Size/MD5: 227628 b52e069ee4517c06b95b4b14b95aa59e

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 241772 99a6d9e681de4b13ad3cb60837ca6147
http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 901744 f1d81f00fa0bbf7775bdad0edb2ec4d4
http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 256908 c41e8695f170564262200f7e62a7b957
http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 238986 5b6a5ea03e02bcbbb9fa598bff76c79a
http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 612932 b0e9af13089554bf808c471692191048
http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 553138 c98be80704783e5ec7fcf608d20e1eae
http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_powerpc.deb
Size/MD5: 231198 b535583753ffe6cc73f7e4a4f20376ee

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/c/clamav/clamav-daemon_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 231630 84ba5b875cb67290c8501ba825199deb
http://ports.ubuntu.com/pool/main/c/clamav/clamav-dbg_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 834302 ed63e23fc9ce4073b14302f2553e4dad
http://ports.ubuntu.com/pool/main/c/clamav/clamav-freshclam_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 251206 f3d18a9ca20dec1a7c5e4046c4fd89f1
http://ports.ubuntu.com/pool/main/c/clamav/clamav_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 231864 5b3aef13761da33bb45e5de6e78fe49c
http://ports.ubuntu.com/pool/main/c/clamav/libclamav-dev_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 576800 361eaadd291deefe4c31ed10ba60a4f2
http://ports.ubuntu.com/pool/main/c/clamav/libclamav5_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 541528 63793c6742c24ea9eae47ba641dd3cf0
http://ports.ubuntu.com/pool/universe/c/clamav/clamav-milter_0.94.dfsg.1-1ubuntu0.1_sparc.deb
Size/MD5: 228470 7c446c73a80ac31c703a26bed6e1117f

--DBIVS5p969aUjpLe
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Kees Cook lt;kees@outflux.netgt;

iEYEARECAAYFAkkh/ecACgkQH/9LqRcGPm1wVwCfVWrTygxlqmvVPNMX0wLGxjip
DSAAn1z2kRFnkXEU490cfeg+8si4Bd8g
=STSH
-----END PGP SIGNATURE-----