安全研究
安全漏洞
ClamAV petite.c无效内存访问绝服务漏洞
发布日期：2008-06-16
更新日期：2008-06-19
受影响系统：
ClamAV ClamAV < 0.93.1不受影响系统：
ClamAV ClamAV 0.93.1描述：
BUGTRAQ ID: 29750
CVE(CAN) ID: CVE-2008-2713
Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。
ClamAV的libclamav/petite.c文件中存在拒绝服务漏洞，如果用户受骗打开了特制的Petite加壳可执行程序的话，就会在以下代码段的memcpy()中触发越界读取，导致拒绝服务的情况：
cli_writeint32(curpe+0x24, 0xffffffff);
memcpy(pefile+rawbase, buffer+sections[i].raw, sections[i].rsz);
rawbase+=PESALIGN(sections[i].rsz, 0x200);
curpe+=40;
datasize+=PESALIGN(sections[i].vsz, 0x1000);
<*来源：Damian Put （pucik@cc-team.org）
链接：http://secunia.com/advisories/30657/
http://sourceforge.net/project/shownotes.php?release_id=605577&group_id=86638
https://wwws.clamav.net/bugzilla/show_bug.cgi?format=multiple&id=1000
http://www.debian.org/security/2008/dsa-1616
http://www.debian.org/security/2008/dsa-1616
http://security.gentoo.org/glsa/glsa-200808-07.xml
*>
建议：
厂商补丁：
Debian
------
Debian已经为此发布了一个安全公告（DSA-1616-1）以及相应补丁:
DSA-1616-1：new clamav packages fix denial of service
链接：http://www.debian.org/security/2008/dsa-1616
补丁下载：
Source archives:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13.diff.gz
Size/MD5 checksum: 213572 2dbfd4ac08c7af42d86f14e36d51a1ba
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13.dsc
Size/MD5 checksum: 900 1956339e5b45defa704f7428d2ca2b8a
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg.orig.tar.gz
Size/MD5 checksum: 11610428 6dc18602b0aa653924d47316f9411e49
Architecture independent packages:
http://security.debian.org/pool/updates/main/c/clamav/clamav-testfiles_0.90.1dfsg-3etch13_all.deb
Size/MD5 checksum: 158352 06513119080bfa3ce5ef244fcfc692f4
http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.90.1dfsg-3etch13_all.deb
Size/MD5 checksum: 1003920 067c6757b73dfe5a89ac3ad78d6bb467
http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.90.1dfsg-3etch13_all.deb
Size/MD5 checksum: 202110 4b03c3a6084dff2fa2915f651b05f5f3
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 372734 b02f13a6b046e16b450c5aa28603270a
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 180766 908d8ba5f5b151eb8ea71616b19fd807
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 182574 23c6d7821e5fc5132211a17a23e65976
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 465116 d414094ddcaccdc223b3e887207cd64c
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 862164 6c6a9ab56700cc5f031194a0116119a4
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 9305100 8fa282fe181b8c7c2a818926638d86e1
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_alpha.deb
Size/MD5 checksum: 597442 d437e275a635d03438943bcd754091b7
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 9302456 749d09d15673706504be022e5ab19cc1
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 593794 acd734b6ddebd1c6648c5ee4a809f911
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 341474 f497da61df358ff5a2c7127b1c0d2ea3
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 355644 cfe37443151e33521ab518f949008fc0
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 178880 81f2aebdcc0e10343c811488691c9b2e
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 177968 6ffbaf669737868284cda847b7b4de8f
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_amd64.deb
Size/MD5 checksum: 856974 30a64aadcef84a5241d18cb669d55431
arm architecture (ARM)
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 336226 46964d05954b2ff7d5d0791614c0194e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 9299564 fe0f3ad0b1be34898583b66c5ebbf542
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 175804 456f92e49076d4ddd31e5862c81564d2
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 853740 3cd48a7cdfdd820d2aaecc1357a05491
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 554038 16515a5a4948051bdb0881a25743cacd
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 335532 cd84e09870119cd4ee240cc398aeb7d3
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_arm.deb
Size/MD5 checksum: 171686 2377a06f744bc30efef5016a9a775913
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 857632 5b07be433b6e7156a435808292136d0e
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 178106 dda3ab5df7c3fa99d502c56a25e00862
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 395736 41fe385be0528b9bf18459e40b375457
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 9303084 e3da50ef5a438446795bc02ab8bb50e1
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 176082 54ec123de579d1a0e2ecd3ec008b0dfe
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 372672 6ced1b7993504e15ef345b1e51af2d6d
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_hppa.deb
Size/MD5 checksum: 571784 859faf2b39164f61920bf5de4470931c
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 175750 dc4b6324abca43d7eea2b11b7fcf660a
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 9299918 9ea5f4014a561d1c8c81bb4ed149aba8
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 559534 44ef9740caff7cb69206597e398f9e3a
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 852928 f0d807d0d78925dfafd6e4df8f395824
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 339634 abda6f85b907020002db72c72bfc9e7f
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 338050 477ce1e1eb226df1025408eee37e1b3b
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_i386.deb
Size/MD5 checksum: 175214 9e7400982700784cc88a1dda2f86265c
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 878958 4eae43d4607166d9eaede40e27ba9049
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 610582 1ec5327570756c197810c12ac8bedb80
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 465670 e7a41cb4e7d18edb10671fb313f8ce44
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 9315790 edd4b8f6c817769a079a51d6489e699e
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 427594 9892748ec0408af2e2a0a87e6874ca63
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 202188 ae7e46c55c72ad3ccef254c1dbe97a33
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_ia64.deb
Size/MD5 checksum: 192468 5ee1e5da5acf7f62ffafb9b9d60a7a55
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 398366 1ea5d9e45ee353c14bee0f5703bdf6e6
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 343322 4fe971ba2fcb742aeed74030e1ced997
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 175468 2db194a35fa157ab609f8ef0b0cb73f5
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 599538 08c09e9897f1972037b3e4a0d88152e6
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 855100 6a21009d59268458b53182735b77088e
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 179602 2523f6024a96923ad91f4945bca418b2
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_mips.deb
Size/MD5 checksum: 9301550 f67d8a2117838a7b6f3eac55ca7a0b72
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 9302024 3f747f0216c64cddf45b350db9772714
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 389592 766e9eb4ed1fba66f22bea2050a07ecb
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 336768 11c61ce9596c22e98f36f69c40fc1e64
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 176436 6f88f1915a6201ab0ae48be641e45ba4
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 855122 82890253e23b4b31ce2c5a926a903691
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 590492 fbc8a71ee8874700ed7156015172cecd
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_mipsel.deb
Size/MD5 checksum: 180486 a9eed083eb4ca3916b0cb78fe6a194fb
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 182286 f3c856dacfa9a1753aa48acface009a0
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 350354 2ade91890102d3887346a1163457b614
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 590798 9a9703d9ebd110de60abae2fca2d4f4c
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 372332 6b66c7903501f622f34e313344f506d6
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 9302874 8cfa88796e81e3c81a05ab9f6635cf24
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 176898 c1f8736fe2f8087c8a895a16327db2cb
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_powerpc.deb
Size/MD5 checksum: 857798 28dd79781db86c13cca7fa189612d648
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 361396 87c393257ceaf3eb7b35bd04ee285e64
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 369912 565ad078b997e6fb7dacfdc11ab01171
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 176852 2f2baf213ee15e2bfa1aa98b6b99f594
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 855724 620223d0a861537d52ee322b6f2e5ad4
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 177666 da21421001162cffbe7647f7f4c8c19b
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 9301446 e00e36a8b4579117dbf4d6fff1c813b2
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_s390.deb
Size/MD5 checksum: 581448 120f580c73cb2a56ac4f50c0d7c5a1f2
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 357690 6481b2987c994cd3877b10efbb1dcc33
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 174568 2a4c4e5782ff3c3231d21dee6fc98fad
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 540908 a710b64a5825f3b7d455c22004a21fda
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 9299230 1c17724dec2769992beb041736371186
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 851874 b405a32bc076c7a788fdc4589bf4f72c
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 349100 acc666ab0383297177d7cff074d43273
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-3etch13_sparc.deb
Size/MD5 checksum: 172622 7e304b28da9bb0fc7e2c94e1b08bbb46
补丁安装方法：
1. 手工安装补丁包：
首先，使用下面的命令来下载补丁软件：
# wget url (url是补丁下载链接地址)
然后，使用下面的命令来安装补丁：
# dpkg -i file.deb (file是相应的补丁名)
2. 使用apt-get自动安装补丁包：
首先，使用下面的命令更新内部数据库：
# apt-get update
然后，使用下面的命令安装更新软件包：
# apt-get upgrade
Gentoo
------
Gentoo已经为此发布了一个安全公告（GLSA-200808-07）以及相应补丁:
GLSA-200808-07：ClamAV: Multiple Denials of Service
链接：http://security.gentoo.org/glsa/glsa-200808-07.xml
所有ClamAV用户都应升级到最新版本：
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.93.3"
ClamAV
------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&path=/branches/0.93/libclamav/petite.c&rev=3886
浏览次数：4393
严重程度：0（网友投票）
绿盟科技给您安全的保障