CVE-2013-6497

Vulnerability

ClamAV before version 0.98.5 contains a denial-of-service vulnerability in the clamscan utility when the -a (archive scanning) option is used. The bug is triggered by specially crafted JavaScript files, such as the jwplayer.js file used as a proof-of-concept [1][2][4]. The issue was discovered by Kurt Seifried and reported in 2013 [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious JavaScript file to a system running clamscan -a. No authentication is required; the attacker only needs to deliver the file via email, web download, or any other vector that triggers ClamAV scanning. The clamscan process will crash upon processing the crafted file [1][4].

Impact

Successful exploitation results in a denial of service (DoS) as the clamscan process crashes. The crash may disrupt antivirus scanning operations, potentially allowing other malicious files to go undetected. The Ubuntu security notice also notes the possibility of arbitrary code execution, though the primary impact described is a crash [4].

Mitigation

The vulnerability is fixed in ClamAV version 0.98.5, released on November 18, 2014 [1][2]. Users should upgrade to ClamAV 0.98.5 or later. Ubuntu provided updates in USN-2423-1 (for Ubuntu 14.10, 14.04 LTS, 12.04 LTS) and USN-2488-2 (for Ubuntu 10.04 LTS) [3][4]. No workaround is documented; upgrading is the recommended action.