^{CVE-2017-12376:}ClamAV AntiVirus Buffer Overflow Vulnerability in PDF Handler

Overview

This vulnerability (CVE-2017-12376) is classified as a CWE-119 (Buffer Overflow) issue affecting ClamAV antivirus software. The vulnerability stems from insufficient boundary checking in the PDF parsing functionality. When ClamAV scans a maliciously crafted PDF file, the handle_pdfname function in pdf.c can be triggered to overflow a buffer, which may lead to denial of service conditions or potentially allow arbitrary code execution. This vulnerability is particularly concerning as ClamAV is widely used in mail servers and gateway systems to scan incoming files, making it a potential attack vector for remote exploitation without authentication.

Remediation

To address this vulnerability, users should upgrade to ClamAV version 0.99.3 or later which contains the security fix. The patch prevents the buffer overflow by implementing proper boundary checking in the PDF handling code.

For systems that cannot be immediately upgraded, consider implementing the following mitigations:

1. Configure systems to quarantine rather than process PDF files if possible
2. Implement network-level filtering to block suspicious PDF files
3. Ensure ClamAV is running with minimal privileges to reduce the impact of potential exploitation
4. Monitor system logs for signs of ClamAV crashes which may indicate exploitation attempts

Linux distribution users should apply security updates provided by their vendors:

• Debian users should apply DLA 1261-1
• Ubuntu users should apply USN-3550-1 or USN-3550-2 as appropriate

References

1. ClamAV 0.99.3 Release Announcement: http://blog.clamav.net/2018/01/clamav-0993-has-been-released.html
2. ClamAV Bug Report and Patch: https://bugzilla.clamav.net/show_bug.cgi?id=11942
3. Debian Security Advisory: https://lists.debian.org/debian-lts-announce/2018/01/msg00035.html
4. Ubuntu Security Notice 3550-1: https://usn.ubuntu.com/3550-1/
5. Ubuntu Security Notice 3550-2: https://usn.ubuntu.com/3550-2/