安全研究
安全漏洞
ClamAV libclamav/pe.c文件MEW包装PE文件整数溢出漏洞
发布日期：2007-12-18
更新日期：2007-12-20
受影响系统：
ClamAV ClamAV 0.91.2不受影响系统：
ClamAV ClamAV 0.92描述：
BUGTRAQ ID: 26927
CVE(CAN) ID: CVE-2007-5759,CVE-2007-6335
Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。
ClamAV中负责解析MEW包装的PE文件的代码存在整数溢出漏洞，本地攻击者可能利用此漏洞提升自己的权限。
在解压过程中，cli_scanpe()函数未经验证用户提供ssize和dsize参数值便直接用于计算所要分配堆缓冲区的大小，这样就可能分配不充分的大小，之后的操作就会导致用用户提供的数据覆盖任意内存区域。
<*来源：Moritz Muehlenhoff
链接：http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog
http://secunia.com/advisories/28117/
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=634
http://www.debian.org/security/2007/dsa-1435
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
建议：
临时解决方法：
* 禁止扫描PE文件。对于clamscan，请以--no-pe选项运行clamscan；对于clamdscan，在clamd.conf文件中将ScanPE选项设置为no。
厂商补丁：
Debian
------
Debian已经为此发布了一个安全公告（DSA-1435-1）以及相应补丁:
DSA-1435-1：New clamav packages fix several vulnerabilities
链接：http://www.debian.org/security/2007/dsa-1435
补丁下载：
Source archives:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1.orig.tar.gz
Size/MD5 checksum: 11643310 cd11c05b5476262eaea4fa3bd7dc25bf
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8.dsc
Size/MD5 checksum: 886 749c91e6c5ba5fc237e8a2176fdadb95
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8.diff.gz
Size/MD5 checksum: 207113 333bd216cf5347d99f59258a3c3a66ed
Architecture independent packages:
http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.90.1-3etch8_all.deb
Size/MD5 checksum: 1005018 117b5356ff6f6b661c1e40fc9d801684
http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.90.1-3etch8_all.deb
Size/MD5 checksum: 201722 aa2b7f1a58ca407b390449ca46f4ab27
http://security.debian.org/pool/updates/main/c/clamav/clamav-testfiles_0.90.1-3etch8_all.deb
Size/MD5 checksum: 157958 49b16840258b5ceedfe0b71b96dbcedb
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 644446 694b0ad3130abf2e2db1e63760362836
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 406370 83cc1d74a4c6f0972d13d06f3a797fb2
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 511388 07bfeca8da437193d8e37bfa67e1795e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 9303942 40bc5413ec2757d45afaafeb4dd780ca
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 184780 ce83079b346a0677478fcda3e8eb82c2
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 180400 ac5d647a73691f65ab65c9c7abf30d2a
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 863570 9020d874cea3fb66cfcad4f13853c714
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 177672 b41de0132a31e306926a539208c9040e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 9301374 ef7c3f347faae5dfeeeb0b23443299f1
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 385814 4ac88e34ed1a21766867874d1147a883
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 639602 1b1cd8162ea42086321c0a4863b23a60
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 177104 560d52f19f0a3faf7aad14ee96b53810
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 367736 206ba38fb4ecaf940159e2cff5471ab4
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 856186 e507b156b818853bafa5ac249759f8ec
arm architecture (ARM)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 363636 cffe11f51a8a7da7805e0653da528742
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 171294 e37b91b2d63de0b2502f27ad3ada1bff
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 598070 2640254d36f5a409f21c3282f3ae9973
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 853018 81f2af2c8dd9549f732a5f71031d48a2
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 9299274 b7db8bdfb726918d10c06e54676e51db
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 175440 f6dc5d29f78684c13c4d49aa9fff7c94
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 366796 ec589953394837dc9e7262881748d1d5
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 405300 f638617d5d10ad818efff8fef2815f9d
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 9303368 f759a6ecd5f1727f5cff479774a2602f
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 618512 e8cbc9c8eca895318be39d9ca4f04523
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 177502 bb227c43e15ee60249c8a5a5f16f1fbd
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 433084 2ce4b1d59e41c5c291c7199bcc6fb9d5
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 178236 7cc4ba752cd13f70620ff7137dbce8a0
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 857310 f7c02fb3d1dee8f7decdffd2a3b6bd3f
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 175186 a9c3384d138654c8e88d68f32cd2d145
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 172496 425b78dc05726d6665e0aafe0997ec3b
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 855838 eee3404134bb37263f0ef0f04bf0337a
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 368002 c4272fb334334b1605ff79c176c00e3e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 9300764 89bd6809bba1487479f7c4aa9cfd06b7
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 604926 5304dab5e5f0c0900b33896ded343b2b
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 365918 b8772ed7682c2028bf275cdcb9230e58
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 521858 ef5910b4071a93492e37ffaa792e54c6
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 9315402 abb8f40eb67f00eb44a7ccbf1ae3d9a5
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 192068 9e517f5aa84a7d3ba7f853aaacd0f194
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 878588 9815569fb986a09e7e0283b46c279cbd
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 201788 30ef29ed88c0f577d441613db29d7134
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 657300 2698e002dad3f5ca8a2daa30f5aa36f6
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 475254 cdbb3e6d452e0bee37691c8d1e21e80d
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 647472 89dcd677a82c850725d27a427074e417
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 175790 2920bababb9c8abc7577aaf2571236c5
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 9301644 210081a84344c3f0fe1f75e3a69f4ccd
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 435676 3fd14c67c544b5072aa40573ed13e86a
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 854796 e2c92a765a76b8c1f28d4b378146ddbc
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 180006 e8827073df24db0522bb7bf825ffeece
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 372486 aa30a661b9ff5547f6abed40e1f78485
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 854742 57beb6f74e26662127429e1d78a824d7
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 180116 846c6c45d717ff883c9cc7e11cc82765
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 365774 d8a1ceb423b0d77b54951002976ac3d8
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 636366 b379e0789244a3bd9dd90b7e21e1c58b
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 9301788 497419c8c083968fc0d54e3121a1095f
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 176030 ac35e877599031d1895304b921d44ae2
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 427180 d682d96e183083ef4a571ec2f7c4298b
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 378618 ac31fa084fdaf402f87afb992d0e4919
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 637410 a814ede334af4f81d029ac4ac8c0fb83
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 405942 effc00cf153a20ed907eed3de9c76a8f
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 181936 e0d817c4c004ff2d180e5c87d5ec26b6
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 176484 dae82dca5708965c50779c18285039f8
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 857412 77892bc52041b4296a19c63f3538028f
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 9302416 db25b250486fc1e45b51c48c71ed8807
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 401940 00f65f05d9cdff66947f94ddb59a6d80
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 391738 5a298a20cd909782920da383ae77ddbd
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 628426 d77305723f25d00e28ec2523b4759da4
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 9301000 4a540d3fffade4b41a28be56e0a9d24f
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 855364 c1e3fc44c8ac430ad96c9a13f2ea8c58
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 177254 ca9f49f7d4836d4db368379bc120c0b6
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 176500 3d0b34e3944ad7b350d52be7cd70a8cd
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 377600 9cd5d18a4719d28d879ba501b45f0582
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 851500 03ec16f173cdb84ea5dbddc775d99788
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 174144 943695d2439ce05aaedaa219c172ca35
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 389560 c3f81ec42378fcd6071ceeec99c8ff65
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 172228 33bd227c0c8ea1c0fb7db99e1e8824bb
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 9298896 2168cb8008c1b7cb0bd593beb567a569
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 584086 bded082a151f4bcc4a5be6d798b99cd7
补丁安装方法：
1. 手工安装补丁包：
首先，使用下面的命令来下载补丁软件：
# wget url (url是补丁下载链接地址)
然后，使用下面的命令来安装补丁：
# dpkg -i file.deb (file是相应的补丁名)
2. 使用apt-get自动安装补丁包：
首先，使用下面的命令更新内部数据库：
# apt-get update
然后，使用下面的命令安装更新软件包：
# apt-get upgrade
ClamAV
------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://freshmeat.net/redir/clamav/29355/url_tgz/clamav-0.92.tar.gz
浏览次数：4499
严重程度：0（网友投票）
绿盟科技给您安全的保障