PT-2005-2762 · Clam Antivirus · Clamav

Published 2005-05-27 · Updated 2016-05-25 · CVE-2005-1795

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Clam AntiVirus (ClamAV) versions prior to 0.85

Description The issue allows remote attackers to execute arbitrary code via a virus in a filename containing shell metacharacters. This occurs when HFS permissions prevent the file from being deleted and ditto is invoked.

Recommendations For versions prior to 0.85, update to version 0.85 or later to resolve the issue. As a temporary workaround, consider restricting access to the filecopy function in misc.c until a patch is available. Avoid using filenames that contain shell metacharacters in the affected filecopy function until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2005-1795

Affected Products

Clamav

References · 3

• 🔥 http://sentinelchicken.com/advisories/clamav · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1795 · Security Note
• http://securitytracker.com/id?1014070 · Vendor Advisory