[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20150503162400.GA2083@breakpoint.cc>
Date: Sun, 3 May 2015 18:24:00 +0200
From: Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-2221: clamav: infinite loop condition on crafted y0da
cryptor file
Y0da cryptor / protector is a PE file encryptor - the executable file is
decrypted on start up. Clamav [0] is able to decrypt such files in order to
scan them. As part of the decryptor there is an op code emulator. A special
crafted file may contain a jump op code to a position that already has been
interpreted - which leads to an endless loop. This leads to an endless loop in
clamav itself.
This has been fixed by [1] and the loop limit has been increased in [2]. This
change is part of the 0.98.7 release.
This bug has been discovered by AFL [3], american fuzzy lop.
[0] http://www.clamav.net/
[1] https://github.com/vrtadmin/clamav-devel/commit/0844d0cfe118b4041ed8e2ee49ff18bfbca8eaa5
[2] https://github.com/vrtadmin/clamav-devel/commit/26b19809fb3b940cb0fda0422d685fff02a53b5f
[3] http://lcamtuf.coredump.cx/afl/
Sebastian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
