CVE-2015-2222

Vulnerability

ClamAV versions prior to 0.98.7 contain a crash vulnerability in the petite unpacker when processing a specially crafted petite packed file [2]. The bug is triggered during scanning of the malformed file, leading to a crash. Affected versions: all ClamAV releases before 0.98.7.

Exploitation

An attacker can exploit this by sending a crafted petite packed file to a system running ClamAV, either via email scanning or on-demand scanning. No authentication is required; the attacker only needs to deliver the file to the scanner. The crash occurs when ClamAV attempts to unpack the malformed petite file.

Impact

Successful exploitation causes ClamAV to crash, resulting in a denial of service. The Ubuntu advisory notes that in the default installation, the ClamAV AppArmor profile would isolate the attacker, limiting potential for arbitrary code execution [1]. The ClamAV blog states the issue is a crash [2]; the Gentoo GLSA mentions possible other unspecified impact [3], but the primary impact is denial of service.

Mitigation

The vulnerability is fixed in ClamAV 0.98.7, released on April 30, 2015 [2]. Users should upgrade to version 0.98.7 or later. Ubuntu released updated packages in USN-2594-1 [1]. Gentoo recommends upgrading to >=app-antivirus/clamav-0.98.7 [3]. No workaround is available.