TippingPoint Zero Day Initiative

Clam AntiVirus UPX Unpacking Code Execution Vulnerability

ZDI-06-001: January 12th, 2006

CVE ID

Affected Vendors

    Clam AntiVirus

Affected Products

    Clam AntiVirus

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable Clam AntiVirus installations. Authentication is not required to exploit this vulnerability.

This specific flaw exists within libclamav/upx.c during the unpacking of executable files compressed with UPX. Due to an invalid size calculation during a data copy from the user-controlled file to heap allocated memory, an exploitable memory corruption condition is created.

Vendor Response

Clam AntiVirus states:

Addressed in Clam AntiVirus version 0.88:

http://sf.net/project/shownotes.php?release_id=384086&group_id=86638


Disclosure Timeline

    2005-12-13 - Vulnerability reported to vendor
    2006-01-12 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Anonymous