ID CVE-2013-2020
Summary Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.
References
Vulnerable Configurations
  • Canonical Ubuntu Linux 13.04
    cpe:2.3:o:canonical:ubuntu_linux:13.04
  • Canonical Ubuntu Linux 12.10
    cpe:2.3:o:canonical:ubuntu_linux:12.10
  • Canonical Ubuntu Linux 12.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts
  • Canonical Ubuntu Linux 11.10
    cpe:2.3:o:canonical:ubuntu_linux:11.10
  • Canonical Ubuntu Linux 10.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts
  • cpe:2.3:o:suse:linux_enterprise_server:11.0:sp1
    cpe:2.3:o:suse:linux_enterprise_server:11.0:sp1
  • cpe:2.3:o:suse:linux_enterprise_server:11.0:sp2
    cpe:2.3:o:suse:linux_enterprise_server:11.0:sp2
  • ClamAV 0.97.1
    cpe:2.3:a:clamav:clamav:0.97.1
  • ClamAV 0.95
    cpe:2.3:a:clamav:clamav:0.95
  • ClamAV 0.97.2
    cpe:2.3:a:clamav:clamav:0.97.2
  • ClamAV 0.97.3
    cpe:2.3:a:clamav:clamav:0.97.3
  • ClamAV 0.95 SRC1
    cpe:2.3:a:clamav:clamav:0.95:src1
  • ClamAV 0.95 SRC2
    cpe:2.3:a:clamav:clamav:0.95:src2
  • ClamAV 0.96 release candidate 2
    cpe:2.3:a:clamav:clamav:0.96:rc2
  • ClamAV 0.96
    cpe:2.3:a:clamav:clamav:0.96
  • ClamAV 0.96 release candidate 1
    cpe:2.3:a:clamav:clamav:0.96:rc1
  • ClamAV 0.95.1
    cpe:2.3:a:clamav:clamav:0.95.1
  • ClamAV 0.95 SRC2
    cpe:2.3:a:clamav:clamav:0.95:rc2
  • ClamAV 0.95.3
    cpe:2.3:a:clamav:clamav:0.95.3
  • ClamAV 0.95.2
    cpe:2.3:a:clamav:clamav:0.95.2
  • ClamAV 0.90 rc3
    cpe:2.3:a:clamav:clamav:0.90:rc3
  • ClamAV 0.91rc1
    cpe:2.3:a:clamav:clamav:0.91:rc1
  • ClamAV 0.91rc2
    cpe:2.3:a:clamav:clamav:0.91:rc2
  • ClamAV 0.95 SRC1
    cpe:2.3:a:clamav:clamav:0.95:rc1
  • ClamAV 0.94 rc1
    cpe:2.3:a:clamav:clamav:0.9:rc1
  • ClamAV 0.90rc1
    cpe:2.3:a:clamav:clamav:0.90:rc1
  • ClamAV 0.90 rc1.1
    cpe:2.3:a:clamav:clamav:0.90:rc1.1
  • ClamAV 0.90 rc2
    cpe:2.3:a:clamav:clamav:0.90:rc2
  • ClamAV 0.92 p0
    cpe:2.3:a:clamav:clamav:0.92_p0
  • ClamAV 0.93
    cpe:2.3:a:clamav:clamav:0.93
  • ClamAV 0.93.2
    cpe:2.3:a:clamav:clamav:0.93.2
  • ClamAV 0.93.3
    cpe:2.3:a:clamav:clamav:0.93.3
  • Clamav 0.90.2
    cpe:2.3:a:clamav:clamav:0.90.2
  • ClamAV 0.90.1 p0
    cpe:2.3:a:clamav:clamav:0.90.1_p0
  • ClamAV 0.90.1
    cpe:2.3:a:clamav:clamav:0.90.1
  • ClamAV 0.90
    cpe:2.3:a:clamav:clamav:0.90
  • ClamAV 0.90.3 p0
    cpe:2.3:a:clamav:clamav:0.90.3_p0
  • ClamAV 0.90.3 p1
    cpe:2.3:a:clamav:clamav:0.90.3_p1
  • ClamAV 0.90.2 p0
    cpe:2.3:a:clamav:clamav:0.90.2_p0
  • ClamAV 0.90.3
    cpe:2.3:a:clamav:clamav:0.90.3
  • ClamAV 0.91.2
    cpe:2.3:a:clamav:clamav:0.91.2
  • ClamAV 0.91.2 p0
    cpe:2.3:a:clamav:clamav:0.91.2_p0
  • ClamAV 0.91
    cpe:2.3:a:clamav:clamav:0.91
  • ClamAV 0.91.1
    cpe:2.3:a:clamav:clamav:0.91.1
  • ClamAV 0.92
    cpe:2.3:a:clamav:clamav:0.92
  • ClamAV 0.96.5
    cpe:2.3:a:clamav:clamav:0.96.5
  • ClamAV 0.92.1
    cpe:2.3:a:clamav:clamav:0.92.1
  • ClamAV 0.93.1
    cpe:2.3:a:clamav:clamav:0.93.1
  • ClamAV 0.94.1
    cpe:2.3:a:clamav:clamav:0.94.1
  • ClamAV 0.96.1
    cpe:2.3:a:clamav:clamav:0.96.1
  • ClamAV 0.96.2
    cpe:2.3:a:clamav:clamav:0.96.2
  • ClamAV 0.96.4
    cpe:2.3:a:clamav:clamav:0.96.4
  • ClamAV 0.96.3
    cpe:2.3:a:clamav:clamav:0.96.3
  • ClamAV 0.97.5
    cpe:2.3:a:clamav:clamav:0.97.5
  • ClamAV 0.97.4
    cpe:2.3:a:clamav:clamav:0.97.4
  • ClamAV 0.94.2
    cpe:2.3:a:clamav:clamav:0.94.2
  • ClamAV 0.94
    cpe:2.3:a:clamav:clamav:0.94
  • ClamAV 0.97
    cpe:2.3:a:clamav:clamav:0.97
  • ClamAV 0.97 Release Candidate
    cpe:2.3:a:clamav:clamav:0.97:rc
  • ClamAV 0.97.7
    cpe:2.3:a:clamav:clamav:0.97.7
CVSS
Base: 5.0 (as of 25-09-2015 - 12:46)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-10853.NASL
    description Fix 963920 Update to 0.97.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 67289
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67289
    title Fedora 19 : clamav-0.97.8-2.fc19 (2013-10853)
  • NASL family Misc.
    NASL id CLAMAV_0_97_8.NASL
    description According to its version, the ClamAV clamd antivirus daemon on the remote host is earlier than 0.97.8 and is, therefore, potentially affected by the following vulnerabilities : - An overflow condition exists in the 'getsisstring()' function in 'libclamav/sis.c' when handling SIS content. This flaw reportedly only affects GNU/Linux. (Issue 6808) - A heap overflow exists in the 'libclamav/pdf.c' when handling a specially crafted encrypted PDF file. This flaw reportedly affects ClamAV 0.97.1 - 0.97.7 only. (Issue 7053) - A heap overflow exists in 'libclamav/pe.c' that is triggered when handling a specially crafted UPX-packed executable. (Issue 7055)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 66308
    published 2013-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66308
    title ClamAV < 0.97.8 Multiple Vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-10980.NASL
    description Fix 963920 Update to 0.97.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 67295
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67295
    title Fedora 17 : clamav-0.97.8-2.fc17 (2013-10980)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-430.NASL
    description New clamav version 0.97.8 (bnc#816865) : - CVE-2013-2020: Fix heap corruption - CVE-2013-2021: Fix overflow due to PDF key length computation.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75004
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75004
    title openSUSE Security Update : clamav (openSUSE-SU-2013:0881-1)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SERVER_2_2_2.NASL
    description The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.2. It is, therefore, affected by the following vulnerabilities : - Two vulnerabilities exist in the included ClamAV software, the most serious of which could allow an attacker to execute arbitrary code remotely. (CVE-2013-2020 / CVE-2013-2021) - Three vulnerabilities exist in the included PostgreSQL software, the most serious of which could result in data corruption or privilege escalation. (CVE-2013-1899 / CVE-2013-1900 / CVE-2013-1901) - Multiple cross-site scripting issues exist in the included Wiki Server software (CVE-2013-1034)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69932
    published 2013-09-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69932
    title Mac OS X : OS X Server < 2.2.2 Multiple Vulnerabilities
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1816-1.NASL
    description It was discovered that ClamAV would incorrectly parse a UPX-packed executable, leading to possible inappropriate heap reads. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2020) It was discovered that ClamAV would incorrectly parse a PDF document, potentially writing beyond the size of a static array. An attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-2021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 66314
    published 2013-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66314
    title Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 / 13.04 : clamav vulnerabilities (USN-1816-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_CLAMAV-130604.NASL
    description This release of clamav provides version 0.97.8 and fixes several potential security issues (bnc#816865) : - Fix heap corruption. (CVE-2013-2020) - Fix overflow due to PDF key length computation. (CVE-2013-2021)
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 66953
    published 2013-06-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66953
    title SuSE 11.2 / 11.3 Security Update : clamav (SAT Patch Numbers 7821 / 7915)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-159.NASL
    description ClamAV 0.97.8 addresses several reported potential security bugs.
    last seen 2018-09-01
    modified 2018-07-19
    plugin id 66286
    published 2013-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66286
    title Mandriva Linux Security Advisory : clamav (MDVSA-2013:159)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-10953.NASL
    description Fix 963920 Update to 0.97.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 67294
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67294
    title Fedora 18 : clamav-0.97.8-2.fc18 (2013-10953)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-8047.NASL
    description Update to 0.97.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 66454
    published 2013-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66454
    title Fedora 18 : clamav-0.97.8-1.fc18 (2013-8047)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201405-08.NASL
    description The remote host is affected by the vulnerability described in GLSA-201405-08 (ClamAV: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in ClamAV. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could send a specially crafted file, leading to arbitrary code execution or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 74051
    published 2014-05-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74051
    title GLSA-201405-08 : ClamAV: Multiple vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2013-004.NASL
    description The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied. This update contains several security-related fixes for the following component : - Apache - Bind - Certificate Trust Policy - ClamAV - Installer - IPSec - Mobile Device Management - OpenSSL - PHP - PostgreSQL - QuickTime - sudo Note that successful exploitation of the most serious issues could result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69878
    published 2013-09-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69878
    title Mac OS X Multiple Vulnerabilities (Security Update 2013-004)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CLAMAV-8606.NASL
    description This update contains clamav 0.97.8 which fixes security issues (bnc#816865) : - Fix heap corruption. (CVE-2013-2020) - Fix overflow due to PDF key length computation. (CVE-2013-2021)
    last seen 2019-02-21
    modified 2013-06-23
    plugin id 66956
    published 2013-06-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66956
    title SuSE 10 Security Update : clamav (ZYPP Patch Number 8606)
refmap via4
apple
  • APPLE-SA-2013-09-12-1
  • APPLE-SA-2013-09-17-1
bid 59434
confirm
fedora
  • FEDORA-2013-10853
  • FEDORA-2013-10953
  • FEDORA-2013-10980
  • FEDORA-2013-8047
mandriva MDVSA-2013:159
mlist
  • [oss-security] 20130424 Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details?
  • [oss-security] 20130429 Re: Multiple potential security issues fixed in ClamAV 0.97.8 - any further details?
secunia
  • 53150
  • 53182
suse
  • SUSE-SU-2014:1571
  • openSUSE-SU-2013:0881
  • openSUSE-SU-2013:0883
ubuntu USN-1816-1
Last major update 28-09-2015 - 12:31
Published 13-05-2013 - 19:55
Back to Top