CVE-2015-1462

Vulnerability

A heap out-of-bounds condition exists in ClamAV's handling of crafted UPX packer files. This vulnerability affects versions prior to 0.98.6. The issue was discovered by Kevin Szkudlapski of Quarkslab and is triggered when scanning a maliciously crafted file packed with UPX, leading to an out-of-bounds heap read/write [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a specific UPX-packed file that, when scanned by a vulnerable ClamAV version, triggers the heap out-of-bounds condition. No authentication is required; the attacker only needs to deliver the malicious file to a system running ClamAV (e.g., via email attachment or network transfer) [2].

Impact

Successful exploitation allows the remote attacker to cause an unspecified impact, as the heap out-of-bounds condition may lead to memory corruption, potential denial of service, or possibly arbitrary code execution. The exact impact is not detailed further in available references [1][2].

Mitigation

The vulnerability is fixed in ClamAV 0.98.6, which was released on January 6, 2015. Users should upgrade to this version or later. The fixed version includes a patch that corrects the heap out-of-bounds condition for crafted UPX packer files [2]. No workarounds are documented; upgrading is the recommended action.