clamav: CVE-2007-0898 - MIME Header Directory Traversal

Debian Bug report logs - #411117
clamav: CVE-2007-0898 - MIME Header Directory Traversal

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: intrigeri@boum.org

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: clamav: CVE-2007-0898 - MIME Header Directory Traversal

Date: Fri, 16 Feb 2007 03:12:29 -0800 (PST)

Package: clamav
Version: 0.84-2.sarge.13
Severity: serious

Hello,

All versions prior to the 0.90 stable release are suspected to be vulnerable to
a directory traversal vulnerability that allows remote attackers to overwrite
files owned by the clamd scanner, such as the virus database file. This has been
assigned the name CVE-2007-0898, and has been fixed in upstream 0.90. A sarge
security fix backport will probably be needed.

Ciao,

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (300, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.18
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to fr_FR.UTF-8)

Versions of packages clamav depends on:
ii  clamav-freshclam [cla 0.84-2.sarge.13    downloads clamav virus databases f
ii  libbz2-1.0            1.0.2-7            high-quality block-sorting file co
ii  libc6                 2.3.2.ds1-22sarge4 GNU C Library: Shared libraries an
ii  libclamav1            0.84-2.sarge.13    virus scanner library
ii  libcurl3              7.13.2-2sarge5     Multi-protocol file transfer libra
ii  libgmp3               4.1.4-6            Multiprecision arithmetic library
ii  libidn11              0.5.13-1.0         GNU libidn library, implementation
ii  libssl0.9.7           0.9.7e-3sarge4     SSL shared libraries
ii  zlib1g                1:1.2.2-4.sarge.2  compression library - runtime

-- no debconf information

Message #10 received at 411117@bugs.debian.org (full text, mbox, reply):

From: Stephen Gran <sgran@debian.org>

To: intrigeri@boum.org, 411117@bugs.debian.org, 411118@bugs.debian.org

Cc: Debian Bug Tracking System <control@bugs.debian.org>

Subject: Re: Bug#411117: clamav: CVE-2007-0898 & CVE-2007-0897

Date: Fri, 16 Feb 2007 12:16:22 +0000

[Message part 1 (text/plain, inline)]

found 411117 0.84-2.sarge.13
found 411117 0.88.7-1
found 411117 0.90~rc3-1
notfound 411117 0.84-2.sarge.14
notfound 411117 0.88.7-2
notfound 411117 0.90-1
close 411117 0.90-1
close 411117 0.88.7-2
close 411117 0.84-2.sarge.14
found 411118 0.84-2.sarge.13
found 411118 0.88.7-1
found 411118 0.90~rc3-1
notfound 411118 0.84-2.sarge.14
notfound 411118 0.88.7-2
notfound 411118 0.90-1
close 411118 0.90-1
close 411118 0.88.7-2
close 411118 0.84-2.sarge.14
thanks

Fixes for these have been uploaded to stable-security, volatile,
testing-proposed-updates, and unstable.  Sorry about any wait time -
it's now out of my hands.
-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran@debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.