PT-2020-5159 · Cisco+2 · Clamav+2
Published
2020-02-05
·
Updated
2026-02-06
·
CVE-2020-3123
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0
Description
A vulnerability in the Data-Loss-Prevention (DLP) module could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device, causing the ClamAV scanning process to crash.
Recommendations
For Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0, consider disabling the DLP feature until a patch is available to prevent exploitation. Restrict access to the DLP module to minimize the risk of denial of service conditions. Avoid processing crafted email files with the affected ClamAV scanning process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Clamav
Suse
Ubuntu