CVE-2014-9328

Vulnerability

In ClamAV versions prior to 0.98.6, a heap out-of-bounds condition exists when processing specially crafted upack packer files. This issue was discovered by Sebastian Andrzej Siewior and is fixed in version 0.98.6 [2]. All versions before 0.98.6 are affected.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious upack packer file and delivering it to a system that uses ClamAV to scan files. No authentication is required; remote attackers can send the file via email, downloads, or other means. Processing the malicious file triggers the heap out-of-bounds condition.

Impact

Successful exploitation could result in a crash (denial of service) or potentially allow arbitrary code execution on the affected system. The Ubuntu advisory [1] confirms the possibility of code execution. The CVE description notes an unspecified impact, but the heap out-of-bounds condition is known to be exploitable.

Mitigation

The vulnerability is fixed in ClamAV version 0.98.6, released in January 2015 [2]. Users should upgrade to version 0.98.6 or later. Ubuntu provided updates for 10.04 LTS, 12.04 LTS, 14.04 LTS, and 14.10 [1]. No workarounds are documented.