ClamAV: Multiple issues
Gentoo Linux Security Advisory
||GLSA 200501-46 / clamav
||January 31, 2005
||May 22, 2006: 02
All supported architectures
ClamAV contains two vulnerabilities that could lead to Denial of Service
and evasion of virus scanning.
ClamAV is an antivirus toolkit. It includes a multi-threaded daemon and
a command line scanner.
ClamAV fails to properly scan ZIP files with special headers
(CAN-2005-0133) and base64 encoded images in URLs.
By sending a base64 encoded image file in a URL an attacker could evade
virus scanning. By sending a specially-crafted ZIP file an attacker
could cause a Denial of Service by crashing the clamd daemon.
There is no known workaround at this time.
All ClamAV users should upgrade to the latest version:
Code Listing 3.1: Resolution
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.81"