Vulnerability-Lookup

WID-SEC-W-2024-0322

Vulnerability from csaf_certbund - Published: 2024-02-07 23:00 - Updated: 2025-07-08 22:00

Summary

ClamAV: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

ClamAV ist ein Open Source Virenscanner. Cisco Secure Endpoint bietet Virenschutz und erweiterte Endpunkt-Erkennung und -Reaktion.

Angriff

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in ClamAV ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder beliebigen Code auszuführen.

Betroffene Betriebssysteme

- Linux - MacOS X - Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "ClamAV ist ein Open Source Virenscanner.\r\nCisco Secure Endpoint bietet Virenschutz und erweiterte Endpunkt-Erkennung und -Reaktion.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in ClamAV ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0322 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0322.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0322 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0322"
      },
      {
        "category": "external",
        "summary": "ClamAV Blog vom 2024-02-07",
        "url": "http://blog.clamav.net/2023/11/clamav-130-122-105-released.html"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory vom 2024-02-07",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2024-471565274B vom 2024-02-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-471565274b"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2024-3439911DF6 vom 2024-02-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-3439911df6"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2024-C42CF0E576 vom 2024-02-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2024-c42cf0e576"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6636-1 vom 2024-02-14",
        "url": "https://ubuntu.com/security/notices/USN-6636-1"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202507-03 vom 2025-07-09",
        "url": "https://security.gentoo.org/glsa/202507-03"
      }
    ],
    "source_lang": "en-US",
    "title": "ClamAV: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-07-08T22:00:00.000+00:00",
      "generator": {
        "date": "2025-07-09T06:05:38.508+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2024-0322",
      "initial_release_date": "2024-02-07T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-02-07T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-02-08T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2024-02-14T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2025-07-08T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Gentoo aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Private Cloud  \u003c3.8.0",
                "product": {
                  "name": "Cisco Secure Endpoint Private Cloud  \u003c3.8.0",
                  "product_id": "T032554"
                }
              },
              {
                "category": "product_version",
                "name": "Private Cloud  3.8.0",
                "product": {
                  "name": "Cisco Secure Endpoint Private Cloud  3.8.0",
                  "product_id": "T032554-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:secure_endpoint:private_cloud___3.8.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Connector \u003c7.5.17",
                "product": {
                  "name": "Cisco Secure Endpoint Connector \u003c7.5.17",
                  "product_id": "T032556"
                }
              },
              {
                "category": "product_version",
                "name": "Connector 7.5.17",
                "product": {
                  "name": "Cisco Secure Endpoint Connector 7.5.17",
                  "product_id": "T032556-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:secure_endpoint:connector__7.5.17"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Connector \u003c8.2.1",
                "product": {
                  "name": "Cisco Secure Endpoint Connector \u003c8.2.1",
                  "product_id": "T032557"
                }
              },
              {
                "category": "product_version",
                "name": "Connector 8.2.1",
                "product": {
                  "name": "Cisco Secure Endpoint Connector 8.2.1",
                  "product_id": "T032557-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:secure_endpoint:connector__8.2.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Endpoint"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.2.2",
                "product": {
                  "name": "Open Source ClamAV \u003c1.2.2",
                  "product_id": "T032551"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.2",
                "product": {
                  "name": "Open Source ClamAV 1.2.2",
                  "product_id": "T032551-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:clamav:clamav:1.2.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.0.5",
                "product": {
                  "name": "Open Source ClamAV \u003c1.0.5",
                  "product_id": "T032552"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.5",
                "product": {
                  "name": "Open Source ClamAV 1.0.5",
                  "product_id": "T032552-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:clamav:clamav:1.0.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ClamAV"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-20290",
      "product_status": {
        "known_affected": [
          "T032556",
          "T032554",
          "T000126",
          "T032557",
          "T012167",
          "T032551",
          "T032552",
          "74185"
        ]
      },
      "release_date": "2024-02-07T23:00:00.000+00:00",
      "title": "CVE-2024-20290"
    },
    {
      "cve": "CVE-2024-20328",
      "product_status": {
        "known_affected": [
          "T032554",
          "T000126",
          "T012167",
          "T032551",
          "T032552",
          "74185"
        ]
      },
      "release_date": "2024-02-07T23:00:00.000+00:00",
      "title": "CVE-2024-20328"
    }
  ]
}

CVE-2024-20290 (GCVE-0-2024-20290)

Vulnerability from cvelistv5 – Published: 2024-02-07 16:16 – Updated: 2025-02-13 17:32

Summary

A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-126 - Buffer Over-read

Assigner

cisco

References

URL

Tags

	https://sec.cloudapps.cisco.com/security/center/c…
	https://lists.fedoraproject.org/archives/list/pac…
	https://lists.fedoraproject.org/archives/list/pac…

Impacted products

Vendor

Product

Version

Cisco

Cisco Secure Endpoint

Affected: 6.0.9
Affected: 6.0.7
Affected: 6.1.5
Affected: 6.1.7
Affected: 6.1.9
Affected: 6.2.1
Affected: 6.2.5
Affected: 6.2.19
Affected: 6.2.3
Affected: 6.2.9
Affected: 6.3.5
Affected: 6.3.1
Affected: 6.3.7
Affected: 6.3.3
Affected: 7.0.5
Affected: 7.1.1
Affected: 7.1.5
Affected: 7.2.13
Affected: 7.2.7
Affected: 7.2.3
Affected: 7.2.11
Affected: 7.2.5
Affected: 7.3.1
Affected: 7.3.9
Affected: 7.3.3
Affected: 7.3.5
Affected: 8.1.7
Affected: 8.1.5
Affected: 8.1.3.21242
Affected: 8.1.7.21512
Affected: 8.1.3
Affected: 8.1.5.21322
Affected: 8.1.7.21417

	Cisco	Cisco Secure Endpoint Private Cloud Administration Portal	Affected: N/A
	Cisco	Cisco Secure Endpoint Private Cloud Console	Affected: N/A

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:59:41.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-clamav-hDffu6t",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-07T20:34:45.866511Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T20:23:12.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Secure Endpoint",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.9"
            },
            {
              "status": "affected",
              "version": "6.0.7"
            },
            {
              "status": "affected",
              "version": "6.1.5"
            },
            {
              "status": "affected",
              "version": "6.1.7"
            },
            {
              "status": "affected",
              "version": "6.1.9"
            },
            {
              "status": "affected",
              "version": "6.2.1"
            },
            {
              "status": "affected",
              "version": "6.2.5"
            },
            {
              "status": "affected",
              "version": "6.2.19"
            },
            {
              "status": "affected",
              "version": "6.2.3"
            },
            {
              "status": "affected",
              "version": "6.2.9"
            },
            {
              "status": "affected",
              "version": "6.3.5"
            },
            {
              "status": "affected",
              "version": "6.3.1"
            },
            {
              "status": "affected",
              "version": "6.3.7"
            },
            {
              "status": "affected",
              "version": "6.3.3"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "7.1.1"
            },
            {
              "status": "affected",
              "version": "7.1.5"
            },
            {
              "status": "affected",
              "version": "7.2.13"
            },
            {
              "status": "affected",
              "version": "7.2.7"
            },
            {
              "status": "affected",
              "version": "7.2.3"
            },
            {
              "status": "affected",
              "version": "7.2.11"
            },
            {
              "status": "affected",
              "version": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.3.1"
            },
            {
              "status": "affected",
              "version": "7.3.9"
            },
            {
              "status": "affected",
              "version": "7.3.3"
            },
            {
              "status": "affected",
              "version": "7.3.5"
            },
            {
              "status": "affected",
              "version": "8.1.7"
            },
            {
              "status": "affected",
              "version": "8.1.5"
            },
            {
              "status": "affected",
              "version": "8.1.3.21242"
            },
            {
              "status": "affected",
              "version": "8.1.7.21512"
            },
            {
              "status": "affected",
              "version": "8.1.3"
            },
            {
              "status": "affected",
              "version": "8.1.5.21322"
            },
            {
              "status": "affected",
              "version": "8.1.7.21417"
            }
          ]
        },
        {
          "product": "Cisco Secure Endpoint Private Cloud Administration Portal",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        },
        {
          "product": "Cisco Secure Endpoint Private Cloud Console",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "N/A"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources.\r\n\r For a description of this vulnerability, see the ClamAV blog ."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "Buffer Over-read",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-14T03:06:14.395Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-clamav-hDffu6t",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/"
        }
      ],
      "source": {
        "advisory": "cisco-sa-clamav-hDffu6t",
        "defects": [
          "CSCwh88483",
          "CSCwh88484"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20290",
    "datePublished": "2024-02-07T16:16:00.975Z",
    "dateReserved": "2023-11-08T15:08:07.627Z",
    "dateUpdated": "2025-02-13T17:32:30.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20328 (GCVE-0-2024-20328)

Vulnerability from cvelistv5 – Published: 2024-03-01 20:48 – Updated: 2025-11-04 18:22

Title

ClamAV VirusEvent File Processing Command Injection Vulnerability

Summary

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

cisco

References

URL

	Vendor	Product	Version
	Cisco	ClamAV	Affected: 1.2.0 Affected: 1.2.1

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2024-0322

CVE-2024-20290 (GCVE-0-2024-20290)

CVE-2024-20328 (GCVE-0-2024-20328)

Tags

Sightings

Nomenclature