Security update for clamav SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3729-1 Final 1 1 2020-12-09T13:44:57Z current 2020-12-09T13:44:57Z 2020-12-09T13:44:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for clamav This update for clamav fixes the following issues: clamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459. * clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. - Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no. * Fix clamav-milter.service (requires clamd.service to run) * Fix freshclam crash in FIPS mode. (bsc#1119353) Update to version 0.102.4: Accumulated security fixes: * CVE-2020-3350: Fix a vulnerability wherein a malicious user could replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (eg. a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan, and clamonacc. (bsc#1174255) * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking results in an out-of-bounds read which could cause a crash. The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly resolves the issue. * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition. Improper error handling may result in a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in versions affected by the vulnerability. (bsc#1174250) * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. (bsc#1171981) * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. (bsc#1157763). * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime config option (bsc#1144504) - Increase the startup timeout of clamd to 5 minutes to cater for the grown virus database as a workaround until clamd has learned to talk to systemd to extend the timeout as long as needed. (bsc#1151839) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2020-3729,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2020-3729,SUSE-2020-3729,SUSE-SLE-SERVER-12-SP5-2020-3729 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ Link for SUSE-SU-2020:3729-1 https://lists.suse.com/pipermail/sle-security-updates/2020-December/007946.html E-Mail link for SUSE-SU-2020:3729-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1118459 SUSE Bug 1118459 https://bugzilla.suse.com/1119353 SUSE Bug 1119353 https://bugzilla.suse.com/1144504 SUSE Bug 1144504 https://bugzilla.suse.com/1149458 SUSE Bug 1149458 https://bugzilla.suse.com/1151839 SUSE Bug 1151839 https://bugzilla.suse.com/1157763 SUSE Bug 1157763 https://bugzilla.suse.com/1171981 SUSE Bug 1171981 https://bugzilla.suse.com/1174250 SUSE Bug 1174250 https://bugzilla.suse.com/1174255 SUSE Bug 1174255 https://www.suse.com/security/cve/CVE-2019-12625/ SUSE CVE CVE-2019-12625 page https://www.suse.com/security/cve/CVE-2019-12900/ SUSE CVE CVE-2019-12900 page https://www.suse.com/security/cve/CVE-2019-15961/ SUSE CVE CVE-2019-15961 page https://www.suse.com/security/cve/CVE-2020-3123/ SUSE CVE CVE-2020-3123 page https://www.suse.com/security/cve/CVE-2020-3327/ SUSE CVE CVE-2020-3327 page https://www.suse.com/security/cve/CVE-2020-3341/ SUSE CVE CVE-2020-3341 page https://www.suse.com/security/cve/CVE-2020-3350/ SUSE CVE CVE-2020-3350 page https://www.suse.com/security/cve/CVE-2020-3481/ SUSE CVE CVE-2020-3481 page Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 clamav-0.103.0-3.3.1 clamav-0.103.0-3.3.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production clamav-0.103.0-3.3.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production clamav-0.103.0-3.3.1 as a component of SUSE Linux Enterprise Server 12 SP5 clamav-0.103.0-3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. CVE-2019-12625 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2019-12625.html CVE-2019-12625 https://bugzilla.suse.com/1144504 SUSE Bug 1144504 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2019-12900.html CVE-2019-12900 https://bugzilla.suse.com/1139083 SUSE Bug 1139083 https://bugzilla.suse.com/1141513 SUSE Bug 1141513 https://bugzilla.suse.com/1149458 SUSE Bug 1149458 A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition. CVE-2019-15961 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2019-15961.html CVE-2019-15961 https://bugzilla.suse.com/1157763 SUSE Bug 1157763 https://bugzilla.suse.com/1180082 SUSE Bug 1180082 A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3123 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2020-3123.html CVE-2020-3123 https://bugzilla.suse.com/1162921 SUSE Bug 1162921 A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3327 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2020-3327.html CVE-2020-3327 https://bugzilla.suse.com/1171980 SUSE Bug 1171980 https://bugzilla.suse.com/1174250 SUSE Bug 1174250 A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3341 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2020-3341.html CVE-2020-3341 https://bugzilla.suse.com/1171981 SUSE Bug 1171981 A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working. CVE-2020-3350 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 important 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2020-3350.html CVE-2020-3350 https://bugzilla.suse.com/1174250 SUSE Bug 1174250 https://bugzilla.suse.com/1174255 SUSE Bug 1174255 A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3481 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:clamav-0.103.0-3.3.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server 12 SP5:clamav-0.103.0-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:clamav-0.103.0-3.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203729-1/ https://www.suse.com/security/cve/CVE-2020-3481.html CVE-2020-3481 https://bugzilla.suse.com/1174250 SUSE Bug 1174250