漏洞信息详情
ClamAV chmunpack.c无效内存访问拒绝服务漏洞
漏洞简介
Clam AntiVirus是Unix的GPL杀毒工具包,很多邮件网关产品都在使用。
ClamAV的libclamav/chmunpack.c文件在解析CHM文件时存在无效的内存访问,如果用户受骗打开了特制的CHM文件就可能导致拒绝服务。
漏洞公告
目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
http://downloads.sourceforge.net/clamav/clamav-0.94.tar.gz
参考网址
来源: VUPEN
名称: ADV-2008-2484
链接:http://www.frsirt.com/english/advisories/2008/2484
来源: sourceforge.net
链接:http://sourceforge.net/project/shownotes.php?group_id=86638&release_id=623661
来源: wwws.clamav.net
链接:https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089
来源: FEDORA
名称: FEDORA-2008-9651
链接:https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00348.html
来源: FEDORA
名称: FEDORA-2008-9644
链接:https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00332.html
来源: SECTRACK
名称: 1020805
链接:http://www.securitytracker.com/id?1020805
来源: BID
名称: 31681
链接:http://www.securityfocus.com/bid/31681
来源: BID
名称: 30994
链接:http://www.securityfocus.com/bid/30994
来源: MANDRIVA
名称: MDVSA-2008:189
链接:http://www.mandriva.com/security/advisories?name=MDVSA-2008:189
来源: VUPEN
名称: ADV-2008-2780
链接:http://www.frsirt.com/english/advisories/2008/2780
来源: VUPEN
名称: ADV-2008-2564
链接:http://www.frsirt.com/english/advisories/2008/2564
来源: svn.clamav.net
链接:http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog
来源: support.apple.com
链接:http://support.apple.com/kb/HT3216
来源: GENTOO
名称: GLSA-200809-18
链接:http://security.gentoo.org/glsa/glsa-200809-18.xml
来源: SECUNIA
名称: 32699
链接:http://secunia.com/advisories/32699
来源: SECUNIA
名称: 32222
链接:http://secunia.com/advisories/32222
来源: SECUNIA
名称: 32030
链接:http://secunia.com/advisories/32030
来源: SECUNIA
名称: 31982
链接:http://secunia.com/advisories/31982
来源: SECUNIA
名称: 31906
链接:http://secunia.com/advisories/31906
来源: SECUNIA
名称: 31725
链接:http://secunia.com/advisories/31725
来源: SUSE
名称: SUSE-SR:2008:018
链接:http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
来源: APPLE
名称: APPLE-SA-2008-10-09
链接:http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
来源: kolab.org
链接:http://kolab.org/security/kolab-vendor-notice-22.txt
来源: MISC
链接:http://int21.de/cve/CVE-2008-1389-clamav-chd.html
受影响实体
- Clam_anti-Virus Clamav:0.80:Rc2<!--2000-1-1-->
- Clam_anti-Virus Clamav:0.80:Rc3<!--2000-1-1-->
- Clam_anti-Virus Clamav:0.93<!--2000-1-1-->
- Clam_anti-Virus Clamav:0.93.1<!--2000-1-1-->
- Clam_anti-Virus Clamav:0.93.3<!--2000-1-1-->
补丁
暂无
还没有评论,来说两句吧...