CVE-2008-0318

Vulnerability

An integer overflow vulnerability exists in the cli_scanpe function within libclamav in ClamAV versions prior to 0.92.1. The flaw is triggered when processing a specially crafted Petite packed PE file, leading to a heap-based buffer overflow [1][2][3]. The vulnerable code path is reachable when ClamAV scans any file, such as during email gateway scanning or on-demand system scans.

Exploitation

An attacker can exploit this vulnerability by sending a malicious Petite-packed PE file to a system running an affected version of ClamAV. No authentication or special network position is required; the file only needs to be scanned by ClamAV (e.g., as an email attachment or via a scheduled scan). The integer overflow occurs during parsing, causing an undersized heap allocation that is subsequently overflowed with attacker-controlled data [2][3].

Impact

Successful exploitation results in a heap-based buffer overflow, which can cause a denial of service (crash) or potentially allow arbitrary code execution. The attacker gains code execution with the privileges of the ClamAV process, typically the clamav user or the system user if clamd is compromised [3]. This could lead to full system compromise depending on the process privileges.

Mitigation

The vulnerability is fixed in ClamAV version 0.92.1, released in February 2008. Users should upgrade to this version or later. Gentoo users can update via emerge --sync && emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.92.1" [3]. SuSE Linux Enterprise and other distributions have provided updated packages [1]. No workaround is available for unpatched installations [3].