PT-2006-3388 · Clam Antivirus+1 · Clamav

Kevin Finisterre · Publicado 2006-05-17 · Atualizado 2018-10-18 · CVE-2006-2427

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Clam Antivirus (ClamAV) version 0.88 ClamXav versions 1.0.3h and earlier

Description The issue allows local users to read portions of arbitrary files when an error message displays the first line of the target file, due to freshclam not dropping privileges before processing the config-file command line option.

Recommendations For Clam Antivirus (ClamAV) version 0.88, consider updating to a newer version that addresses the privilege handling issue. For ClamXav versions 1.0.3h and earlier, consider updating to a newer version that addresses the privilege handling issue. As a temporary workaround, consider restricting access to the config-file command line option to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-2427

Produtos afetados

Clamav

Referências · 8

• 🔥 http://securitytracker.com/id?1016086 · Exploit
• http://securityreason.com/securityalert/912 · Nota
• http://securityfocus.com/archive/1/434008/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2427 · Nota de Segurança
• http://secunia.com/advisories/20085 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1807 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26453 · Nota
• http://digitalmunition.com/DMA%5B2006-0514a%5D.txt · Nota