Date: Mon, 09 Feb 2004 14:50:23 +0100 From: Oliver Eikemeier <eikemeier@fillmore-labs.com> To: FreeBSD-gnats-submit@FreeBSD.org Cc: TERAMOTO Masahiro <markun@onohara.to> Subject: ports/62586: [SECURITY] security/clamav: trivial DOS attack Message-ID: <4027901F.1090105@fillmore-labs.com> Resent-Message-ID: <200402091400.i19E0XGM038391@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 62586 >Category: ports >Synopsis: [SECURITY] security/clamav: trivial DOS attack >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Feb 09 06:00:33 PST 2004 >Closed-Date: >Last-Modified: >Originator: Oliver Eikemeier >Release: FreeBSD 4.9-STABLE i386 >Organization: Fillmore Labs - http://www.fillmore-labs.com >Environment: System: FreeBSD nuuk.fillmore-labs.com 4.9-STABLE >Description: It is trivial to crash clamd using a malformed uuencoded message, resulting in a denial of service for all programs (e.g. SMTP daemons) relying on clamd running. The message must only contain one uuencoded line with an illegal line lenght, i.e. starting with a small letter. libclamav calculates the line lenght of an uuencoded line by taking the ASCII value of the first character minus 64 and does an `assert' if the length is not in the allowed range, effectively terminating the calling program. >How-To-Repeat: Save the following file to ~/clamtest.mbox, removing the leading 'X': XFrom - X Xbegin 644 byebye Xbyebye Xend Then do: # clamscan --mbox -v ~/clamtest.mbox assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887 Abort (core dumped) or # clamdscan -v ~/clamtest.mbox; ps ax | grep clam >Fix: Add the following in files/patch-libclamav::message.c: --- libclamav/message.c.orig Wed Nov 5 11:59:53 2003 +++ libclamav/message.c Mon Feb 9 13:57:48 2004 @@ -884,7 +884,8 @@ len = *line++ - ' '; - assert((len >= 0) && (len <= 63)); + if (len < 0 || len > 63) + break; ptr = decode(line, ptr, uudecode, (len & 3) == 0); break; >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4027901F.1090105>