Bug 213762 - app-antivirus/clamav <0.93 Multiple issues (CVE-2008-{0314,1100,1387,1833,1835,1836,1837})
|
Bug#:
213762
(CVE-2008-0314)
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: major
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: rbu@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
http://secunia.com/secunia_research/2008-11/advisory/
|
|
Summary: app-antivirus/clamav <0.93 Multiple issues (CVE-2008-{0314,1100,1387,1833,1835,1836,1837})
|
|
Keywords:
|
|
Status Whiteboard: B1 [glsa]
|
|
Opened: 2008-03-18 01:40 0000
|
Secunia:
The vulnerability is caused due to a boundary error within the
"cli_scanpe()" function in libclamav/pe.c. This can be exploited to
cause a heap-based buffer overflow via a specially crafted "Upack"
executable.
ClamAV upstream will not fix this vulnerability in their 0.92 branch, but
*after* 0.93 has been released, soon in one of their updates.
No patches are available at this time, scanning using this module has been
disabled. Embargo date is currently 2008-04-09.
any update on the timeline, since the embargo date has passed?
Can't see any 0.93 release yet...
CC'ing infra, since clamav is also used here iirc
*** Bug 217771 has been marked as a duplicate of this bug. ***
There are hangs and crashes too.
http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog
Mon Apr 14 21:35:11 CEST 2008 (tk)
----------------------------------
* Check in 0.93 patches:
- libclamunrar: bb#541 (RAR - Version required to extract - Evasion)
- libclamav/spin.c: bb#876 (PeSpin Heap Overflow Vulnerability)
- libclamav/pe.c: bb#878 (Upack Buffer Overflow Vulnerability)
- libclamav/message.c: bb#881 (message.c: read beyond allocated region)
- libclamav/unarj.c: bb#897 (ARJ: Sample from CERT-FI hangs clamav)
- libclamunrar: bb#898 (RAR crashes on some fuzzed files from CERT-FI)
I pushed 0.93 in portage. I had to use AT_M4DIR="m4", see
www.gossamer-threads.com/lists/clamav/devel/37726
Hi arches, please test clamav-0.93 and mark stable if OK.
That's odd. Right after installation I get this:
# clamd
clamd: error while loading shared libraries: libclamunrar_iface.so.3: cannot
open shared object file: No such file or directory
# ldd `which clamd`|less
libclamav.so.4 => /usr/lib/libclamav.so.4 (0x4048d000)
libz.so.1 => /lib/libz.so.1 (0x40364000)
libbz2.so.1 => /lib/libbz2.so.1 (0x4008d000)
libgmp.so.3 => /usr/lib/libgmp.so.3 (0x400e1000)
libclamunrar_iface.so.4 => /usr/lib/libclamunrar_iface.so.4
(0x4088f000)
libclamunrar.so.4 => /usr/lib/libclamunrar.so.4 (0x4026f000)
libpthread.so.0 => /lib/libpthread.so.0 (0x402e4000)
libc.so.6 => /lib/libc.so.6 (0x40609000)
/lib/ld.so.1 (0x400a1000)
libclamunrar_iface.so.3 => not found
It's linked to both libclamunrar_iface.so.3 and libclamunrar_iface.so.4? Should
be easy to fix...
*** Bug 217809 has been marked as a duplicate of this bug. ***
(In reply to comment #8)
> I pushed 0.93 in portage. I had to use AT_M4DIR="m4", see
> www.gossamer-threads.com/lists/clamav/devel/37726
>
>
> Hi arches, please test clamav-0.93 and mark stable if OK.
>
No, the current ebuild is not ready for general consumption. I came across this
libunrar weirdness last night, but it was getting late, so I plan to work on it
today. BTW, it builds just fine when no clamav is installed, so there might be
some glitch in the build system - using libclamunrar_iface.so installed on
system if it exists (e.g. if clamav-0.92.1 is installed, which had
libclamunrar_iface.so.3).
Also, iconv configure option has been added, and some other minor stuff. I will
let you know when an ebuild is ready. Masked it for now.
OK, back to [ebuild] status.
I can't reproduce that behaviour while upgrading frop 0.92.1 to 0.93.
Everything was fine on two different boxes. I also tried upgrading from
0.92.1-r1 to 0.93.
[falco:/usr/local/portage/app-antivirus]130# /usr/bin/ldd /usr/sbin/clamd
linux-gate.so.1 => (0xb7f05000)
libclamav.so.4 => /usr/lib/libclamav.so.4 (0xb7e7c000)
libz.so.1 => /lib/libz.so.1 (0xb7e6b000)
libgmp.so.3 => /usr/lib/libgmp.so.3 (0xb7e3c000)
libclamunrar_iface.so.4 => /usr/lib/libclamunrar_iface.so.4
(0xb7e38000)
libclamunrar.so.4 => /usr/lib/libclamunrar.so.4 (0xb7e2e000)
libpthread.so.0 => /lib/libpthread.so.0 (0xb7e17000)
libc.so.6 => /lib/libc.so.6 (0xb7ce6000)
/lib/ld-linux.so.2 (0xb7f06000)
If that upgrade is really a problem then we will backport the patch on 0.92.1.
i'm attaching it.
(In reply to comment #12)
> BTW, it builds just fine when no clamav is installed, so there might be
> some glitch in the build system - using libclamunrar_iface.so installed on
> system if it exists (e.g. if clamav-0.92.1 is installed, which had
> libclamunrar_iface.so.3).
It also builds fine when the same version is already installed. And yes, it
certainly is a build system issue (libtool?).
OK, this is a bit too complicated for me. For some reason, libclamav links to
libclamunrar and libclamunrar_iface libraries which are installed on system
(/usr/lib), in addition to freshly compiled ones in working dir.
Thing is, I have no idea why, or how to fix it. Can anyone bit better skilled
with libtool lend a hand here? Otherwise, I'm just going to wait for maintainer
or $someone to fix it, before I can add an ebuild do the tree...
(In reply to comment #16)
> OK, this is a bit too complicated for me. For some reason, libclamav links to
> libclamunrar and libclamunrar_iface libraries which are installed on system
> (/usr/lib), in addition to freshly compiled ones in working dir.
Which is weird is that i can't reproduce that behaviour... even from 0.92.1,
even from 0.92.1-rc1...
What i can do is to (try to) backport the patches for 0.92.1
... i finally managed to find a way to reproduce the bug: by using bash instead
of zsh. I'm investigating.
During the "install" phase, a command introduces a
./work/clamav-0.93/libclamav/.libs/libclamav.so.4.0.1T file that contains a
reference to the old libclamunrar_iface.so.3.
The command that introduces this reference is:
(cd /data/var/tmp/portage/app-antivirus/clamav-0.93/work/clamav-0.93/libclamav;
/bin/sh ../libtool --tag=CC --mode=relink i686-pc-linux-gnu-gcc -O2
-march=pentium4 -fomit-frame-pointer -thread-safe -version-info 4:1:0
-no-undefined -Wl,--version-script,../libclamav/libclamav.map -o libclamav.la
-rpath /usr/lib matcher-ac.lo matcher-bm.lo matcher.lo md5.lo others.lo
readdb.lo cvd.lo dsig.lo str.lo scanners.lo textdet.lo filetypes.lo rtf.lo
blob.lo mbox.lo message.lo table.lo text.lo ole2_extract.lo vba_extract.lo
msexpand.lo pe.lo upx.lo htmlnorm.lo chmunpack.lo rebuildpe.lo petite.lo
wwunpack.lo unsp.lo aspack.lo packlibs.lo fsg.lo mew.lo upack.lo line.lo
untar.lo unzip.lo inflate64.lo special.lo binhex.lo is_tar.lo tnef.lo autoit.lo
strlcpy.lo regcomp.lo regerror.lo regexec.lo regfree.lo unarj.lo bzlib.lo
nulsft.lo infblock.lo pdf.lo spin.lo yc.lo elf.lo sis.lo uuencode.lo
phishcheck.lo phish_domaincheck_db.lo phish_whitelist.lo regex_list.lo
mspack.lo cab.lo entconv.lo hashtab.lo dconf.lo lzma_iface.lo explode.lo
textnorm.lo -lz -L/usr/lib -lbz2 -L/usr/lib -lgmp -lpthread lzma/liblzma.la
../libclamunrar_iface/libclamunrar_iface.la -inst-prefix-dir
/data/var/tmp/portage/app-antivirus/clamav-0.93/image/)
I'm not sure, but note the double "-L/usr/lib"
After that command, i have a new libclamav.so.4.0.1T :
$ find -name "libclamav.so*" -type f
./work/clamav-0.93/libclamav/.libs/libclamav.so.4.0.1
./work/clamav-0.93/libclamav/.libs/libclamav.so.4.0.1T
which contains the evil:
$ strings ./work/clamav-0.93/libclamav/.libs/libclamav.so.4.0.1T|grep iface
libclamunrar_iface.so.3
Dirty, but works. updated 0.93 ebuild committed and unmasked.
Okay, let's try again, dear arches!
target:
clamav-0.93 alpha amd64 hppa ia64 ppc ppc64 sparc x86
What should be tried is emerging 0.93 while having 0.92.1 (or its -r1, doesn't
matter) installed, and then checking dynamic linking. Stuff from comment #9
must not happen.
This will break klamav. Maybe other reverse deps won't work, too - I only
tested klamav. Happens on amd64/x86.
make[3]: Leaving directory
`/var/tmp/portage/app-antivirus/klamav-0.42/work/klamav-0.42-source/klamav-0.42/src/sqlite'
Making all in klammail
make[3]: Entering directory
`/var/tmp/portage/app-antivirus/klamav-0.42/work/klamav-0.42-source/klamav-0.42/src/klammail'
i686-pc-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I. -I../.. -I/usr/kde/3.5/include
-I/usr/qt/3/include -I. -I/usr/kde/3.5/include -DQT_THREAD_SUPPORT
-D_REENTRANT -DNDEBUG -O2 -O2 -march=i686 -pipe -c clamdmail.c
clamdmail.c: In function 'clamdscan':
clamdmail.c:210: error: 'struct cl_limits' has no member named 'maxmailrec'
clamdmail.c:211: error: 'struct cl_limits' has no member named 'maxratio'
make[3]: *** [clamdmail.o] Error 1
make[3]: Leaving directory
`/var/tmp/portage/app-antivirus/klamav-0.42/work/klamav-0.42-source/klamav-0.42/src/klammail'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory
`/var/tmp/portage/app-antivirus/klamav-0.42/work/klamav-0.42-source/klamav-0.42/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory
`/var/tmp/portage/app-antivirus/klamav-0.42/work/klamav-0.42-source/klamav-0.42'
make: *** [all] Error 2
*
* ERROR: app-antivirus/klamav-0.42 failed.
* Call stack:
* ebuild.sh, line 49: Called src_compile
* environment, line 4137: Called kde_src_compile
* environment, line 2858: Called kde_src_compile 'src_compile'
* environment, line 2978: Called kde_src_compile 'src_compile'
'all' 'myconf'
* environment, line 2974: Called die
* The specific snippet of code:
* emake || die "died running emake, $FUNCNAME:make"
* The die message:
* died running emake, kde_src_compile:make
(In reply to comment #22)
> What should be tried is emerging 0.93 while having 0.92.1 (or its -r1, doesn't
> matter) installed, and then checking dynamic linking. Stuff from comment #9
> must not happen.
It's still happening with CVS revision 1.2:
elmer ~ # qlop -lu clamav | tail -n 2
Thu Apr 17 22:13:41 2008 >>> app-antivirus/clamav-0.92.1
Fri Apr 18 05:58:55 2008 >>> app-antivirus/clamav-0.93
elmer ~ # ldd `which clamd`
libclamav.so.4 => /usr/lib/libclamav.so.4 (0x40213000)
libz.so.1 => /lib/libz.so.1 (0x40364000)
libbz2.so.1 => /lib/libbz2.so.1 (0x4008d000)
libgmp.so.3 => /usr/lib/libgmp.so.3 (0x400e1000)
libclamunrar_iface.so.4 => /usr/lib/libclamunrar_iface.so.4
(0x4061f000)
libclamunrar.so.4 => /usr/lib/libclamunrar.so.4 (0x4033d000)
libpthread.so.0 => /lib/libpthread.so.0 (0x402e4000)
libc.so.6 => /lib/libc.so.6 (0x40a09000)
/lib/ld.so.1 (0x400a1000)
libclamunrar_iface.so.3 => not found
elmer ~ # qfile `which clamd`
app-antivirus/clamav (/usr/sbin/clamd)
(In reply to comment #24)
>
> It's still happening with CVS revision 1.2:
> elmer ~ # qlop -lu clamav | tail -n 2
> Thu Apr 17 22:13:41 2008 >>> app-antivirus/clamav-0.92.1
> Fri Apr 18 05:58:55 2008 >>> app-antivirus/clamav-0.93
> elmer ~ # ldd `which clamd`
> libclamav.so.4 => /usr/lib/libclamav.so.4 (0x40213000)
> libz.so.1 => /lib/libz.so.1 (0x40364000)
> libbz2.so.1 => /lib/libbz2.so.1 (0x4008d000)
> libgmp.so.3 => /usr/lib/libgmp.so.3 (0x400e1000)
> libclamunrar_iface.so.4 => /usr/lib/libclamunrar_iface.so.4
> (0x4061f000)
> libclamunrar.so.4 => /usr/lib/libclamunrar.so.4 (0x4033d000)
> libpthread.so.0 => /lib/libpthread.so.0 (0x402e4000)
> libc.so.6 => /lib/libc.so.6 (0x40a09000)
> /lib/ld.so.1 (0x400a1000)
> libclamunrar_iface.so.3 => not found
> elmer ~ # qfile `which clamd`
> app-antivirus/clamav (/usr/sbin/clamd)
>
Can you post somewhere the output of the install phase, please. Or just the
"libtool ... -o libclamav.la ..." line.
Is someone else able to trigger that stuff?
Works for me now, thanks. :)
(In reply to comment #25)
> (In reply to comment #24)
>
> >
> > It's still happening with CVS revision 1.2:
> > elmer ~ # qlop -lu clamav | tail -n 2
> > Thu Apr 17 22:13:41 2008 >>> app-antivirus/clamav-0.92.1
> > Fri Apr 18 05:58:55 2008 >>> app-antivirus/clamav-0.93
> > elmer ~ # ldd `which clamd`
> > libclamav.so.4 => /usr/lib/libclamav.so.4 (0x40213000)
> > libz.so.1 => /lib/libz.so.1 (0x40364000)
> > libbz2.so.1 => /lib/libbz2.so.1 (0x4008d000)
> > libgmp.so.3 => /usr/lib/libgmp.so.3 (0x400e1000)
> > libclamunrar_iface.so.4 => /usr/lib/libclamunrar_iface.so.4
> > (0x4061f000)
> > libclamunrar.so.4 => /usr/lib/libclamunrar.so.4 (0x4033d000)
> > libpthread.so.0 => /lib/libpthread.so.0 (0x402e4000)
> > libc.so.6 => /lib/libc.so.6 (0x40a09000)
> > /lib/ld.so.1 (0x400a1000)
> > libclamunrar_iface.so.3 => not found
> > elmer ~ # qfile `which clamd`
> > app-antivirus/clamav (/usr/sbin/clamd)
> >
>
> Can you post somewhere the output of the install phase, please. Or just the
> "libtool ... -o libclamav.la ..." line.
>
> Is someone else able to trigger that stuff?
>
Reping Jeroen, can you reproduce it while emerging from 0.92.1?
(In reply to comment #27)
> Reping Jeroen, can you reproduce it while emerging from 0.92.1?
Going from 0.92.1 to 0.93 seems alright. I'll test once more and stabilise for
HPPA when I'm satisfied.
alpha/ia64/sparc/x86 stable
This one breaks dansguardian:
x86_64-pc-linux-gnu-g++ -DHAVE_CONFIG_H -I. -I.. -I/usr/include
-I/usr/include -fexceptions -O2 -mtune=opteron -march=opteron
-fomit-frame-pointer -pipe -MT clamdscan.o -MD -MP -MF .deps/clamdscan.Tpo -c
-o clamdscan.o `test -f 'contentscanners/clamdscan.cpp' || echo
'./'`contentscanners/clamdscan.cpp
contentscanners/clamav.cpp: In member function ‘virtual int
clamavinstance::init(void*)’:
contentscanners/clamav.cpp:265: error: ‘struct cl_limits’ has no member
named ‘maxratio’
contentscanners/clamav.cpp:266: error: ‘struct cl_limits’ has no member
named ‘maxratio’
contentscanners/clamav.cpp:267: error: ‘struct cl_limits’ has no member
named ‘maxratio’
make[2]: *** [clamav.o] Error 1
make[2]: *** Waiting for unfinished jobs....
mv -f .deps/dansguardian.Tpo .deps/dansguardian.Po
mv -f .deps/clamdscan.Tpo .deps/clamdscan.Po
mv -f .deps/FOptionContainer.Tpo .deps/FOptionContainer.Po
mv -f .deps/OptionContainer.Tpo .deps/OptionContainer.Po
make[2]: Leaving directory
`/tmp/portage/net-proxy/dansguardian-2.9.9.3_beta/work/dansguardian-2.9.9.3/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory
`/tmp/portage/net-proxy/dansguardian-2.9.9.3_beta/work/dansguardian-2.9.9.3'
make: *** [all] Error 2
did you see the warning during configure ?
config.status: creating docs/man/clamd.conf.5
config.status: creating docs/man/clamdscan.1
config.status: creating docs/man/clamscan.1
config.status: creating docs/man/freshclam.1
config.status: creating docs/man/freshclam.conf.5
config.status: creating docs/man/sigtool.1
config.status: creating clamav-config.h
config.status: executing depfiles commands
configure: WARNING:
****** WARNING:
****** You are either cross compiling to a different host or
****** you have manually disabled important configure checks.
****** Please be aware that this build may be badly broken.
****** DO NOT REPORT BUGS BASED ON THIS BUILD !!!
make all-recursive
make[1]: Entering directory
`/var/tmp/portage/app-antivirus/clamav-0.93/work/clamav-0.93'
Making all in libclamunrar
Should we wait till compile errors with klamav and Mail-ClamAV are fixed?
(In reply to comment #35)
> Should we wait till compile errors with klamav and Mail-ClamAV are fixed?
>
That's up to the respective maintainers for these packages to decide. Klamav
has a new version since Apr 30th, and there is a patch for Mail-ClamAV
available on abovementioned bug.
Do compile issues in dependent packages warrant holding off on a security
issue? I don't think so, but I leave that up to you guys.
(In reply to comment #35)
> Should we wait till compile errors with klamav and Mail-ClamAV are fixed?
Please mark 0.93 stable for ppc and ppc64. When other packages are broken due
to the upgrade, and there is a fix available, please mark the corresponding
bugs as blockers of this bug and we will go through a fast stabling of those
packages.
(In reply to comment #37)
> Do compile issues in dependent packages warrant holding off on a security
> issue? I don't think so [...]
How comes I never had to dicide; now it's clear: Priority(Security) >
Priority(No Breakage of other packages)
ppc64 stable.
Fixed in release snapshot. Also fixed Mail-ClamAV and klamav.
Uh, drop my comment about "fixed Mail-ClamAV". It's not fixed. For interested
parties tracker of clamav-0.93 breakages was created in bug #221715.
Arches, please test and mark stable:
=app-antivirus/clamav-0.93.3
Target keywords : "alpha amd64 hppa ia64 ppc ppc64 sparc x86"
(In reply to comment #45)
> gah, wrong bug.
removing sparc, too
it was GLSA 200805-19 unless i'm wrong. Closing.
