Cisco addressed a critical vulnerability in the ClamAV open source antivirus engine that can lead to remote code execution on vulnerable devices.
Cisco fixed a critical flaw, tracked as CVE-2023-20032 (CVSS score: 9.8), in the ClamAV open source antivirus engine. The vulnerability resides in the residing in the HFS+ file parser component, an attacker can trigger the issue to gain remote code execution on vulnerable devices or trigger a DoS condition.
Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser.
The vulnerability affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. The company acknowledged Simon Scannell from Google for reporting this issue.
The vulnerability is a buffer overflow issue affecting the ClamAV scanning library, it is due to a missing buffer size check.
“This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device.” reads the advisory published by Cisco. “A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.”
The vulnerability affects the following products:
| Cisco Product | Cisco Bug ID | Fixed Release Availability |
|---|---|---|
| Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Linux | CSCwd74133 | 1.20.21 |
| Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for MacOS | CSCwd74134 | 1.21.11 |
| Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Windows | CSCwd74135 | 7.5.9 1 8.1.5 |
| Secure Endpoint Private Cloud | CSCwe18204 | 3.6.0 or later with updated connectors2 |
| Secure Web Appliance, formerly Web Security Appliance | CSCwd74132 | 14.0.4-005 15.0.0-254 |
Secure Email Gateway, formerly Email Security Appliance, and Secure Email and Web Manager, formerly Security Management Appliance, are not impacted.
The IT giant says that there is not workaround for this vulnerability, the good news is that the company Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploiting this vulnerability.
Cisco also addressed another vulnerability, tracked as CVE-2023-20052, in the ClamAV engine. The flaw is a possible remote information leak vulnerability in the DMG file parser.
The vulnerability affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
“This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device.” reads the advisory. “A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ClamAV)
