CVE-2008-1100

Vulnerability

A heap-based buffer overflow vulnerability exists in the cli_scanpe() function in libclamav/pe.c of ClamAV versions 0.92 and 0.92.1 [1]. The flaw is triggered when scanning a Portable Executable (PE) file that has been packed with the UPack executable packer [1]. A boundary error during unpacking causes a heap buffer overflow, potentially allowing an attacker to overwrite adjacent memory [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious UPack PE file and delivering it to a target system [1]. No authentication is required; the attacker only needs to entice a user or automated system (e.g., an email gateway running ClamAV) to scan the file [2]. Once scanned, the overflow occurs within the cli_scanpe() function, leading to code execution [1].

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user running ClamAV (commonly a limited system account or the clamav user if running as clamd) [1][2]. Alternatively, the overflow can cause ClamAV to crash, resulting in a denial of service [1].

Mitigation

Users should upgrade to ClamAV version 0.93, which was released to address this vulnerability [1]. As a workaround, the ClamAV team disabled scanning of UPack-packed PE files in older versions, but this limits functionality [1]. Administrators should also avoid running clamscan as root to limit the impact of potential compromises [1]. No other workaround is known [2].