Summary
The remote host is missing an update to clamav
announced via advisory DSA 1616-2.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201616-2
Insight
This update corrects a packaging and build error in the packages released in DSA-1616-1. Those packages, while functional, did not actually apply the fix intended. This update restores the fix to the package build
no other changes are introduced. For
reference, the text of the original advisory follows.
Damian Put discovered a vulnerability in the ClamAV anti-virus toolkit's parsing of Petite-packed Win32 executables. The weakness leads to an invalid memory access, and could enable an attacker to crash clamav by supplying a maliciously crafted Petite-compressed binary for scanning. In some configurations, such as when clamav is used in combination with mail servers, this could cause a system to fail open, facilitating a follow-on viral attack.
The Common Vulnerabilities and Exposures project identifies this weakness as CVE-2008-2713.
For the stable distribution (etch), this problem has been fixed in version 0.90.1dfsg-3.1+etch14. For the unstable distribution (sid), the problem has been fixed in version 0.93.1.dfsg-1.1.
We recommend that you upgrade your clamav packages.
Severity
Classification
-
CVE CVE-2008-2713 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
Related Vulnerabilities