PT-2007-7426 · Cisco · Clamav

Published 2007-12-31 · Updated 2024-06-15 · CVE-2007-6595

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ClamAV version 0.92

Description The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files or .ascii files when utf16-decode is enabled. This can be achieved by exploiting the cli gentempfd function in libclamav/others.c or the sigtool.

Recommendations For ClamAV version 0.92, consider disabling the utf16-decode option to minimize the risk of exploitation. Additionally, restrict access to the cli gentempfd function and sigtool to prevent potential attacks.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2007-6595

DSA-1497-1

OPENSUSE-SU-2024:10685-1

Affected Products

Clamav

References · 75

• http://secunia.com/advisories/28949 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-6595 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00009.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6595 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6595 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10685-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200808-07.xml · Vendor Advisory
• http://debian.org/security/2008/dsa-1497 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:088 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-12374 · Note
• https://suse.com/security/cve/CVE-2007-6335 · Note
• https://suse.com/security/cve/CVE-2020-3341 · Note
• https://suse.com/security/cve/CVE-2007-0897 · Note
• https://suse.com/security/cve/CVE-2017-6419 · Note