PT-2019-15256 · Cisco+2 · Clamav+2
Published
2019-03-28
·
Updated
2024-06-15
·
CVE-2019-1798
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
ClamAV Software versions 0.101.1 and prior
Description
A vulnerability in the Portable Executable (PE) file scanning functionality could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The issue is due to a lack of proper input and validation checking mechanisms for PE files sent to an affected device. An attacker could exploit this by sending malformed PE files to the device, potentially causing an out-of-bounds read condition and resulting in a crash that leads to a denial of service condition.
Recommendations
For ClamAV Software versions 0.101.1 and prior, update to a version later than 0.101.1 to resolve the issue. As a temporary workaround, consider restricting the handling of PE files by the affected software until a patch is available.
Exploit
Fix
DoS
RCE
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Clamav
Suse