{"id":113460,"date":"2024-02-08T16:02:41","date_gmt":"2024-02-08T14:02:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cisco-vypustila-antivirusnyj-paket-clamav-1-3-0-i-ustranila-opasnuyu-uyazvimost"},"modified":"2024-02-08T16:02:41","modified_gmt":"2024-02-08T14:02:41","slug":"kompaniya-cisco-vypustila-antivirusnyj-paket-clamav-1-3-0-i-ustranila-opasnuyu-uyazvimost","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cisco-vypustila-antivirusnyj-paket-clamav-1-3-0-i-ustranila-opasnuyu-uyazvimost","title":{"rendered":"Cisco has released the ClamAV 1.3.0 antivirus package and addressed a serious vulnerability","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After six months of development, Cisco has released the free antivirus package ClamAV 1.3.0. The project came under Cisco's control in 2013 following the acquisition of Sourcefire, the company that develops ClamAV and Snort. The project's code is distributed under the GPLv2 license. The 1.3.0 branch is classified as a regular (non-LTS) version, with updates published for at least four months following the release of the first version of the subsequent branch. The ability to download signature databases for non-LTS branches is also guaranteed for at least another four months after the release of the next branch. <\/p>\n
Key Improvements in ClamAV 1.3: <\/p>\n
\n
Support has been added for extracting and verifying attachments used in Microsoft OneNote files. OneNote format parsing is enabled by default, but can be disabled via the 'ScanOneNote no' setting in clamd.conf, by specifying the command line option '--scan-onenote=no' when running the clamscan utility, or by adding the CL_SCAN_PARSE_ONENOTE flag to the options.parse parameter when using libclamav.\n
ClamAV has been successfully built for the BeOS-like operating system Haiku.\n
In clamd, a check for the existence of the directory for temporary files specified in clamd.conf via the TemporaryDirectory directive has been added. If this directory is missing, the process now terminates with an error message.\n
When configuring the build of static libraries in CMake, the installation of the static libraries libclamav_rust, libclammspack, libclamunrar_iface, and libclamunrar used in libclamav has been ensured.\n
File type detection for compiled Python scripts (.pyc) has been implemented. The file type is passed as a string parameter CL_TYPE_PYTHON_COMPILED, which is supported in the functions clcb_pre_cache, clcb_pre_scan, and clcb_file_inspection.\n
Support for decrypting PDF documents with empty passwords has been improved. <\/ul>\n
Simultaneously, updates for ClamAV 1.2.2 and 1.0.5 have been released, fixing two vulnerabilities affecting the branches 0.104, 0.105, 1.0, 1.1, and 1.2: <\/p>\n
\n
CVE-2024-20328 \u2014 the possibility of command injection during file checking in clamd due to a flaw in the implementation of the 'VirusEvent' directive, which is used to execute arbitrary commands when a virus is detected. Exploitation details are not currently disclosed, but it is known that the issue has been mitigated by disabling support for the '%f' string formatting parameter in VirusEvent, which was replaced with the name of the infected file.\n
It seems that the attack involves passing a specially crafted name of an infected file containing unescaped special characters during the execution of the command specified in VirusEvent. Notably, a similar vulnerability was fixed back in 2004 by also removing support for the '%f' substitution, which was later reintroduced in ClamAV version 0.104 and led to the resurgence of the old vulnerability. In the old vulnerability, to execute their command during virus checks, it was sufficient to create a file with the name '; mkdir owned' and write a test virus signature into it. <\/p>\n
CVE-2024-20290 \u2014 a buffer overflow in the code that parses files containing OLE2 format content, which a remote unauthenticated attacker can exploit to cause a denial of service (crash of the scanning process). The issue arises from inadequate end-of-line checks during content scanning, leading to reading out of bounds of the buffer. <\/ul>\n