CVE-2015-2170

Vulnerability

The UPX decoder in ClamAV before version 0.98.7 contains a flaw that can be triggered by a specially crafted file. An attacker can cause a crash in the decoder, leading to a denial of service. [1][2]

Exploitation

An attacker needs only to provide a crafted file to the ClamAV scanner. No authentication or special network position is required; the file can be delivered via email, web traffic, or any other vector that ClamAV scans. The crash occurs when the UPX decoder processes the malicious input. [1][2]

Impact

Successful exploitation causes ClamAV to crash, resulting in a denial of service. The advisory notes that an unspecified remote attacker could also possibly execute arbitrary code, though the primary known impact is a crash. In Ubuntu's default installation, the ClamAV AppArmor profile would isolate the scanner, reducing potential harm. [1][2]

Mitigation

ClamAV 0.98.7 contains the fix for CVE-2015-2170, released on 2015-04-21. Users should upgrade to this version or later. The Gentoo advisory (GLSA 201512-08) also recommends upgrading to >=app-antivirus/clamav-0.98.7. No known workaround exists. [1][2][3]