PT-2006-3388 · Clam Antivirus+1 · Clamav

Kevin Finisterre · Published 2006-05-17 · Updated 2018-10-18 · CVE-2006-2427

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Clam Antivirus (ClamAV) version 0.88 ClamXav versions 1.0.3h and earlier

Description The issue allows local users to read portions of arbitrary files when an error message displays the first line of the target file, due to freshclam not dropping privileges before processing the config-file command line option.

Recommendations For Clam Antivirus (ClamAV) version 0.88, consider updating to a newer version that addresses the privilege handling issue. For ClamXav versions 1.0.3h and earlier, consider updating to a newer version that addresses the privilege handling issue. As a temporary workaround, consider restricting access to the config-file command line option to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-2427

Affected Products

Clamav

References · 8

• 🔥 http://securitytracker.com/id?1016086 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2427 · Security Note
• http://secunia.com/advisories/20085 · Vendor Advisory
• http://securityreason.com/securityalert/912 · Note
• http://securityfocus.com/archive/1/434008/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/1807 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26453 · Note
• http://digitalmunition.com/DMA%5B2006-0514a%5D.txt · Note