Bug 27020 - clamav new security issues CVE-2020-3350 and CVE-2020-3481
Summary: clamav new security issues CVE-2020-3350 and CVE-2020-3481
Status: ASSIGNED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-29 23:08 CEST by David Walser
Modified: 2020-07-30 09:33 CEST (History)
2 users (show)

See Also:
Source RPM: clamav-0.102.3-1.mga7.src.rpm
CVE: CVE-2020-3350, CVE-2020-3481
Status comment:


Attachments

Description David Walser 2020-07-29 23:08:27 CEST
Upstream has released ClamAV 0.102.4 on July 16, fixing security issues:
https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html

Ubuntu has issued an advisory for this on July 27:
https://ubuntu.com/security/notices/USN-4435-1

Mageia 7 is also affected.
David Walser 2020-07-29 23:08:46 CEST

Whiteboard: (none) => MGA7TOO
CC: (none) => mageia, nicolas.salguero

Comment 1 Nicolas Salguero 2020-07-30 09:33:57 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working. (CVE-2020-3350)

A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. (CVE-2020-3481)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3350
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3481
https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html
https://ubuntu.com/security/notices/USN-4435-1
========================

Updated packages in core/updates_testing:
========================
clamav-0.102.4-1.mga7
clamd-0.102.4-1.mga7
clamav-milter-0.102.4-1.mga7
clamav-db-0.102.4-1.mga7
lib(64)clamav9-0.102.4-1.mga7
lib(64)clamav-devel-0.102.4-1.mga7

from SRPM:
clamav-0.102.4-1.mga7.src.rpm

Status: NEW => ASSIGNED
Version: Cauldron => 7
Whiteboard: MGA7TOO => (none)
CVE: (none) => CVE-2020-3350, CVE-2020-3481
Source RPM: clamav-0.102.3-1.mga8.src.rpm => clamav-0.102.3-1.mga7.src.rpm
Assignee: bugsquad => qa-bugs


Note You need to log in before you can comment on or make changes to this bug.