CVE-2007-6336

Vulnerability

An off-by-one error exists in ClamAV versions prior to 0.92 when decompressing MS-ZIP compressed CAB files. This flaw resides in the CAB decompression code and can be triggered when scanning a specially crafted file. All versions before 0.92 are affected [1].

Exploitation

A remote attacker can craft a malicious CAB file using MS-ZIP compression. If a user or automated system (e.g., a mail gateway) scans this file with a vulnerable ClamAV version, the off-by-one error is triggered. No authentication or special privileges are required; the attack relies on the target processing the file [1].

Impact

Successful exploitation allows arbitrary code execution with the privileges of the user running ClamAV. This could be a system user or the clamav user if clamd is compromised, leading to full compromise of the scanning process and potential system access [1].

Mitigation

Upgrade to ClamAV 0.92 or later. Gentoo users can install >=app-antivirus/clamav-0.91.2-r1 as a patched version. No known workaround exists for unpatched installations [1].