• Synopsis

  The antivirus running on the remote host is affected by a remote code execution vulnerability.

• Description

  The version of ClamAV installed on the remote host is prior to 0.103.8, 0.104.x prior to 0.105.2 or 1.0.x prior to 1.0.1. It is, therefore, affected by a remote code execution vulnerability in the HFS+ partition file parser of the ClamAV scanning library. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

• Solution

  Upgrade to ClamAV version 0.103.8, 0.105.2, 1.0.1 or later.

• See Also

  LINKS:
  
  nist.gov 
  clamav.net 

• Plugin Output

  Path : /opt/freeware/bin/clamscan
  Installed version : 0.104.2
  Fixed version : 0.105.2

  .

  .

  Here ist the thing - we have installed 0.104.2 on our systems and You provided an updated version 0.103.8 (which is the most up2date file on the FTP) - which is indeed fixed - but this would be a downgrade for us. 

  So my question is, if it would be possible to provide a 0.105.2 or higher version? We would be very thankful.

Note: this finding does not affect AIX and I don't know why Tenable is popping up that finding in the first place - this is a finding regarding HFS+ - but it is easier for us to fix it than to create an accept risk rule because of a false positive. Also a downgrade is something that I want to avoid. There is also a discussion about support end of version 0.103.x

Thanks and keep up the good work

Martin

• Synopsis

  The antivirus running on the remote host is affected by a remote code execution vulnerability.

• Description

  The version of ClamAV installed on the remote host is prior to 0.103.8, 0.104.x prior to 0.105.2 or 1.0.x prior to 1.0.1. It is, therefore, affected by a remote code execution vulnerability in the HFS+ partition file parser of the ClamAV scanning library. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

• Solution

  Upgrade to ClamAV version 0.103.8, 0.105.2, 1.0.1 or later.

• See Also

  LINKS:
  
  nist.gov 
  clamav.net 

• Plugin Output

  Path : /opt/freeware/bin/clamscan
  Installed version : 0.104.2
  Fixed version : 0.105.2

  .

  .

  Here ist the thing - we have installed 0.104.2 on our systems and You provided an updated version 0.103.8 (which is the most up2date file on the FTP) - which is indeed fixed - but this would be a downgrade for us. 

  So my question is, if it would be possible to provide a 0.105.2 or higher version? We would be very thankful.

Note: this finding does not affect AIX and I don't know why Tenable is popping up that finding in the first place - this is a finding regarding HFS+ - but it is easier for us to fix it than to create an accept risk rule because of a false positive. Also a downgrade is something that I want to avoid. There is also a discussion about support end of version 0.103.x

Thanks and keep up the good work

Martin

• Synopsis

  The antivirus running on the remote host is affected by a remote code execution vulnerability.

• Description

  The version of ClamAV installed on the remote host is prior to 0.103.8, 0.104.x prior to 0.105.2 or 1.0.x prior to 1.0.1. It is, therefore, affected by a remote code execution vulnerability in the HFS+ partition file parser of the ClamAV scanning library. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

• Solution

  Upgrade to ClamAV version 0.103.8, 0.105.2, 1.0.1 or later.

• See Also

  LINKS:
  
  nist.gov 
  clamav.net 

• Plugin Output

  Path : /opt/freeware/bin/clamscan
  Installed version : 0.104.2
  Fixed version : 0.105.2

  .

  .

  Here ist the thing - we have installed 0.104.2 on our systems and You provided an updated version 0.103.8 (which is the most up2date file on the FTP) - which is indeed fixed - but this would be a downgrade for us. 

  So my question is, if it would be possible to provide a 0.105.2 or higher version? We would be very thankful.

Note: this finding does not affect AIX and I don't know why Tenable is popping up that finding in the first place - this is a finding regarding HFS+ - but it is easier for us to fix it than to create an accept risk rule because of a false positive. Also a downgrade is something that I want to avoid. There is also a discussion about support end of version 0.103.x

Thanks and keep up the good work

Martin

• Synopsis

  The antivirus running on the remote host is affected by a remote code execution vulnerability.

• Description

  The version of ClamAV installed on the remote host is prior to 0.103.8, 0.104.x prior to 0.105.2 or 1.0.x prior to 1.0.1. It is, therefore, affected by a remote code execution vulnerability in the HFS+ partition file parser of the ClamAV scanning library. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

• Solution

  Upgrade to ClamAV version 0.103.8, 0.105.2, 1.0.1 or later.

• See Also

  LINKS:
  
  nist.gov 
  clamav.net 

• Plugin Output

  Path : /opt/freeware/bin/clamscan
  Installed version : 0.104.2
  Fixed version : 0.105.2

  .

  .

  Here ist the thing - we have installed 0.104.2 on our systems and You provided an updated version 0.103.8 (which is the most up2date file on the FTP) - which is indeed fixed - but this would be a downgrade for us. 

  So my question is, if it would be possible to provide a 0.105.2 or higher version? We would be very thankful.

Note: this finding does not affect AIX and I don't know why Tenable is popping up that finding in the first place - this is a finding regarding HFS+ - but it is easier for us to fix it than to create an accept risk rule because of a false positive. Also a downgrade is something that I want to avoid. There is also a discussion about support end of version 0.103.x

Thanks and keep up the good work

Martin

• Synopsis

  The antivirus running on the remote host is affected by a remote code execution vulnerability.

• Description

  The version of ClamAV installed on the remote host is prior to 0.103.8, 0.104.x prior to 0.105.2 or 1.0.x prior to 1.0.1. It is, therefore, affected by a remote code execution vulnerability in the HFS+ partition file parser of the ClamAV scanning library. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

• Solution

  Upgrade to ClamAV version 0.103.8, 0.105.2, 1.0.1 or later.

• See Also

  LINKS:
  
  nist.gov 
  clamav.net 

• Plugin Output

  Path : /opt/freeware/bin/clamscan
  Installed version : 0.104.2
  Fixed version : 0.105.2

  .

  .

  Here ist the thing - we have installed 0.104.2 on our systems and You provided an updated version 0.103.8 (which is the most up2date file on the FTP) - which is indeed fixed - but this would be a downgrade for us. 

  So my question is, if it would be possible to provide a 0.105.2 or higher version? We would be very thankful.

Note: this finding does not affect AIX and I don't know why Tenable is popping up that finding in the first place - this is a finding regarding HFS+ - but it is easier for us to fix it than to create an accept risk rule because of a false positive. Also a downgrade is something that I want to avoid. There is also a discussion about support end of version 0.103.x

Thanks and keep up the good work

Martin

• Synopsis

  The antivirus running on the remote host is affected by a remote code execution vulnerability.

• Description

  The version of ClamAV installed on the remote host is prior to 0.103.8, 0.104.x prior to 0.105.2 or 1.0.x prior to 1.0.1. It is, therefore, affected by a remote code execution vulnerability in the HFS+ partition file parser of the ClamAV scanning library. An unauthenticated, remote attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. Successful exploitation could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

• Solution

  Upgrade to ClamAV version 0.103.8, 0.105.2, 1.0.1 or later.

• See Also

  LINKS:
  
  nist.gov 
  clamav.net 

• Plugin Output

  Path : /opt/freeware/bin/clamscan
  Installed version : 0.104.2
  Fixed version : 0.105.2

  .

  .

  Here ist the thing - we have installed 0.104.2 on our systems and You provided an updated version 0.103.8 (which is the most up2date file on the FTP) - which is indeed fixed - but this would be a downgrade for us. 

  So my question is, if it would be possible to provide a 0.105.2 or higher version? We would be very thankful.

Note: this finding does not affect AIX and I don't know why Tenable is popping up that finding in the first place - this is a finding regarding HFS+ - but it is easier for us to fix it than to create an accept risk rule because of a false positive. Also a downgrade is something that I want to avoid. There is also a discussion about support end of version 0.103.x

Thanks and keep up the good work

Martin