CVE-2007-0897 Common Vulnerabilities and Exposures

Upstream information

CVE-2007-0897 at MITRE

Description

Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	None
Availability Impact	Partial

CVSS v3 Scores
	National Vulnerability Database
Base Score	7.5
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	None
Integrity Impact	None
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entry: 246214 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE-SA:2007:017, published Fri, 23 Feb 2007 16:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Server 11 SP1	`clamav >= 0.96-0.12.1`	Patchnames: SUSE Linux Enterprise Server 11 SP1 GA clamav-0.96-0.12.1
SUSE Linux Enterprise Server 11 SP2	`clamav >= 0.97.3-0.2.1`	Patchnames: SUSE Linux Enterprise Server 11 SP2 GA clamav-0.97.3-0.2.1
SUSE Linux Enterprise Server 11 SP3	`clamav >= 0.97.7-0.3.1`	Patchnames: SUSE Linux Enterprise Server 11 SP3 GA clamav-0.97.7-0.3.1
SUSE Linux Enterprise Server 11 SP4	`clamav >= 0.98.7-0.3.1`	Patchnames: SUSE Linux Enterprise Server 11 SP4 GA clamav-0.98.7-0.3.1
openSUSE Tumbleweed	`clamav >= 0.103.3-1.4` `clamav-devel >= 0.103.3-1.4` `clamav-milter >= 0.103.3-1.4` `libclamav9 >= 0.103.3-1.4` `libfreshclam2 >= 0.103.3-1.4`	Patchnames: openSUSE-Tumbleweed-2024-10685

SUSE Timeline for this CVE

CVE page created: Fri Jun 28 02:16:51 2013
CVE page last modified: Mon Sep 9 20:56:18 2024