For the English version of this alert, click here.
Allele Security Alert
ASA-2019-00648
Identificador(es)
ASA-2019-00648
Título
Out-of- bounds write na biblioteca bzip2 do NSIS do ClamAV
Fabricante(s)
Cisco Systems
Produto(s)
ClamAV
Versão(ões) afetada(s)
ClamAV versões anteriores à 0.101.4
Versão(ões) corrigida(s)
ClamAV versão 0.101.4
Prova de Conceito
Desconhecido
Descrição
Um out-of-bounds write foi possível na biblioteca bzip2 do NSIS do ClamAV ao tentar descompactar nos casos em que o número de seletores excedeu o limite máximo definido pela biblioteca (CVE-2019-12900).
Detalhes técnicos
Desconhecido
Créditos
Martin Simmons
Referência(s)
ClamAV 0.101.4 security patch release has been published
https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html
Possible instance of CVE-2019-12900 in libclamav/nsis/bzlib.c
https://bugzilla.clamav.net/show_bug.cgi?id=12371
bb12371 – nsis – manually adding patch by Albert Astals Cid to mitigate bzip2 CVE-2019-12900
https://github.com/Cisco-Talos/clamav-devel/commit/0249be88182ffeac9a3677736a1be2021c6c1b05
Make sure nSelectors is not out of range
https://sourceware.org/git/?p=bzip2.git;a=commitdiff;h=7ed62bfb46e87a9e878712603469440e6882b184
Accept as many selectors as the file format allows.
https://sourceware.org/git/?p=bzip2.git;a=commitdiff;h=b07b105d1b66e32760095e3602261738443b9e13
https://access.redhat.com/security/cve/CVE-2019-12900
CVE-2019-12900 in Ubuntu
https://people.canonical.com/~ubuntu-security/cve/CVE-2019-12900.html
CVE-2019-12900 | SUSE
https://www.suse.com/security/cve/CVE-2019-12900
CVE-2019-12900
https://security-tracker.debian.org/tracker/CVE-2019-12900
CVE-2019-12900
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900
CVE-2019-12900
https://nvd.nist.gov/vuln/detail/CVE-2019-12900
Se encontrou algum erro neste alerta ou deseja uma análise compreensiva, entre em contato.
Última modificação: 8 dezembro 2019