PT-2017-3503 · Cisco+3 · Clamav+3
Publicado
2017-10-26
·
Atualizado
2026-02-06
·
CVE-2017-12379
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
ClamAV AntiVirus software versions 0.99.2 and prior
Description
The issue is due to improper input validation checking mechanisms in the message parsing function, specifically the
messageAddArgument function in message.c, which can lead to a buffer overflow condition. An unauthenticated, remote attacker could exploit this by sending a crafted email to the affected device, potentially causing a denial of service condition or executing arbitrary code.Recommendations
For ClamAV AntiVirus software versions 0.99.2 and prior, consider updating to a version that addresses the improper input validation in the message parsing function to prevent potential exploitation. As a temporary workaround, consider restricting the handling of emails by ClamAV to minimize the risk of exploitation until a patch is available.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Clamav
Suse
Ubuntu