Bug 62586

Summary: [SECURITY] security/clamav: trivial DOS attack
Product: Ports & Packages Reporter: Oliver Eikemeier <eikemeier>
Component: Individual Port(s)Assignee: Oliver Eikemeier <eik>
Status: Closed FIXED    
Severity: Affects Only Me CC: markun
Priority: Normal    
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff
none
patch-libclamav--message.c none

Description Oliver Eikemeier 2004-02-09 14:00:33 UTC 
It is trivial to crash clamd using a malformed uuencoded message, resulting in a
denial of service for all programs (e.g. SMTP daemons) relying on clamd running.
The message must only contain one uuencoded line with an illegal line lenght, i.e.
starting with a small letter.

libclamav calculates the line lenght of an uuencoded line by taking the ASCII value
of the first character minus 64 and does an `assert' if the length is not in the
allowed range, effectively terminating the calling program.

Fix: Add the following in files/patch-libclamav::message.c:
How-To-Repeat: 
Save the following file to ~/clamtest.mbox, removing the leading 'X':

XFrom -
X
Xbegin 644 byebye
Xbyebye
Xend

Then do:

# clamscan --mbox -v ~/clamtest.mbox
assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887
Abort (core dumped)

or

# clamdscan -v ~/clamtest.mbox; ps ax | grep clam
Comment 1 Oliver Eikemeier freebsd_committer freebsd_triage 2004-02-09 14:02:10 UTC 
Responsible Changed
From-To: freebsd-ports-bugs->eik

I'll take it.
Comment 2 Oliver Eikemeier 2004-02-09 14:21:38 UTC 
Argh! Fixed patch:

--- libclamav/message.c.orig	Wed Nov  5 11:59:53 2003
+++ libclamav/message.c	Mon Feb  9 15:17:13 2004
@@ -878,13 +878,16 @@
 			if(strcasecmp(line, "end") == 0)
 				break;
 
-			assert(strlen(line) <= 62);
+			if(strlen(line) > 62)
+				break;
+
 			if((line[0] & 0x3F) == ' ')
 				break;
 
 			len = *line++ - ' ';
 
-			assert((len >= 0) && (len <= 63));
+			if(len < 0 || len > 63)
+				break;
 
 			ptr = decode(line, ptr, uudecode, (len & 3) == 0);
 			break;
Comment 3 njh 2004-02-09 15:12:41 UTC 
This has been fixed in the latest code (see CVS) for sometime.

-- 
Nigel Horne. Arranger, Composer, Typesetter.
NJH Music, Barnsley, UK.  ICQ#20252325
njh@despammed.com http://www.bandsman.co.uk
Comment 4 Oliver Eikemeier 2004-02-09 15:18:14 UTC 
Nigel Horne wrote:

> This has been fixed in the latest code (see CVS) for sometime.

... but not in the relase version, which most production servers will run.
Comment 5 Rui Lopes 2004-02-09 22:47:13 UTC 
Hi,

In the attachment is a patch that was retreived directly from 
clamav-devel sources.


Regards,
Rui Lopes
Comment 6 Oliver Eikemeier freebsd_committer freebsd_triage 2004-02-11 10:16:06 UTC 
State Changed
From-To: open->closed

fixed.