clamav 0.65 remote DOS exploit

[Oliver Eikemeier]

>Description:

It is trivial to crash clamd using a malformed uuencoded message, resulting in a
denial of service for all programs (e.g. SMTP daemons) relying on clamd running.
The message must only contain one uuencoded line with an illegal line lenght, i.e.
starting with a small letter.

libclamav calculates the line lenght of an uuencoded line by taking the ASCII value
of the first character minus 64 and does an `assert' if the length is not in the
allowed range, effectively terminating the calling program.

>How-To-Repeat:

Save the following file to ~/clamtest.mbox, removing the leading 'X':

XFrom -
X
Xbegin 644 byebye
Xbyebye
Xend

Then do:

# clamscan --mbox -v ~/clamtest.mbox
assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887
Abort (core dumped)

or

# clamdscan -v ~/clamtest.mbox; ps ax | grep clam

>Fix:

Apply the following patch to libclamav/message.c:

--- libclamav/message.c.orig Wed Nov 5 11:59:53 2003
+++ libclamav/message.c Mon Feb 9 15:17:13 2004
@@ -878,13 +878,16 @@
if(strcasecmp(line, "end") == 0)
break;

- assert(strlen(line) <= 62);
+ if(strlen(line) > 62)
+ break;
+
if((line[0] & 0x3F) == ' ')
break;

len = *line++ - ' ';

- assert((len >= 0) && (len <= 63));
+ if(len < 0 || len > 63)
+ break;

ptr = decode(line, ptr, uudecode, (len & 3) == 0);
break;

>References:

FreeBSD PR 62586:
<http://www.freebsd.org/cgi/query-pr.cgi?pr=62586>

[Oliver Eikemeier]

Nigel Horne wrote:

> I tried reproducing the problem with the latest source in CVS, but had no problems.
> 0.65 is rather old, please try again with the latest version.

0.65 ist the latest stable (release) version, so I guess most production servers would
run it, instead of an CVS snapshot.

-Oliver

[Nigel Horne]

I tried reproducing the problem with the latest source in CVS, but had no problems.
0.65 is rather old, please try again with the latest version.

[njh@mac tmp]$ clamscan --mbox f
f: OK

----------- SCAN SUMMARY -----------
Known viruses: 20667
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.00 MB
I/O buffer size: 131072 bytes
Time: 2.497 sec (0 m 2 s)
[njh@mac tmp]$ cat f
From -

begin 644 byebye
byebye
end
[njh@mac tmp]$

-Nigel

--
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
njh@despammed.com http://www.bandsman.co.uk

[Stefan Triller]

Hi,

> > I tried reproducing the problem with the latest source in CVS, but
> > had no problems. 0.65 is rather old, please try again with the
> > latest version.
>
> 0.65 ist the latest stable (release) version, so I guess most
> production servers would run it, instead of an CVS snapshot.

I have version 0.65-1 for debian from:
deb http://people.debian.org/~aurel32/BACKPORTS stable main

and this ist not affected.

--
Mfg Stefan

[Mark Renouf]

Oliver Eikemeier wrote:

> 0.65 ist the latest stable (release) version, so I guess most production
> servers would
> run it, instead of an CVS snapshot.

Are earlier versions than 0.65 affected?

Gentoo's portage tree has 0.60 as latest stable, and 0.65 is in testing
(~x86.. masked, but available). Nothing in CVS is allowed into portage.

[Oliver Eikemeier]

Stefan Triller wrote:
> Hi,
>
>
>>>I tried reproducing the problem with the latest source in CVS, but
>>>had no problems. 0.65 is rather old, please try again with the
>>>latest version.
>>
>>0.65 ist the latest stable (release) version, so I guess most
>>production servers would run it, instead of an CVS snapshot.
>
>
> I have version 0.65-1 for debian from:
> deb http://people.debian.org/~aurel32/BACKPORTS stable main
>
> and this ist not affected.

They patched the sources, thankfully.

[Dennis Freise]

--Signature=_Tue__10_Feb_2004_10_41_02_+0100_I+KXHAS QneCB=PwS
Content-Type: text/plain; charset=US-ASCII
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

On Mon, 09 Feb 2004 17:13:44 -0500
Mark Renouf <mark@tweakt.net> wrote:

> Gentoo's portage tree has 0.60 as latest stable, and 0.65 is in testing
> (~x86.. masked, but available). Nothing in CVS is allowed into portage.

Here is my homemade version of an ebuild for the snapshot of yesterday:
http://www.final-frontier.ath.cx/ebuilds/clamav-0.66_pre20040209.ebuild
You also need the following patch, put it in the files directory:
http://www.final-frontier.ath.cx/ebuilds/clamav-0.66_pre20040209.diff

I'm using it since yesterday and it works just fine. If clamd refuses to start
after upgrading wait until freshclam has refreshed your virus-dbs and then
restart clamd.

Disclaimer: Use at your own risk! I'm not a gentoo developer, so DO NOT report
bugs to bugs.gentoo.org, or the gentoo-people will beat me to death ;-)

--
Dennis Freise <cat@final-frontier.ath.cx>
GnuPG key fingerprint: 2DE8 CCEF 6E20 11D4 3B27 21EC B0BA 1749 D2C8 38ED
Get my public key at : http://www.final-frontier.ath.cx/gpg_public_key.txt

--Signature=_Tue__10_Feb_2004_10_41_02_+0100_I+KXHAS QneCB=PwS
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)

iD8DBQFAKKcusLoXSdLIOO0RAh2hAJ9iMvYjJZQYGpaL8k14oL ioaQAE1QCfUJE7
w64/0vYj459PdhsOQkk5z2A=
=taH7
-----END PGP SIGNATURE-----

--Signature=_Tue__10_Feb_2004_10_41_02_+0100_I+KXHAS QneCB=PwS--

[Khalid J Hosein]

> Nigel Horne wrote:
>
>> I tried reproducing the problem with the latest source in CVS, but
>> had no problems.
>> 0.65 is rather old, please try again with the latest version.
>
>
> 0.65 ist the latest stable (release) version, so I guess most
> production servers would
> run it, instead of an CVS snapshot.
>
> -Oliver

I also tried reproducing the problem using the release version, but
could not duplicate the results (clamd crash).
I'm interested though in finding out if others can in fact duplicate
this behaviour, and if you can, what the end effect is if you're passing
requests to clamd from amavisd-new
(http://www.ijs.si/software/amavisd/). Thx!

_Khalid