Researcher Demonstrates Remote ClamAV Exploitation Through Email

Summary

Simon Scannell demonstrated a research exploit chaining an out-of-bounds read and a heap overflow to achieve remote code execution against ClamAV in a Zimbra email-server setup.

Key points

• The exploit assumes an attacker can cause ClamAV to scan crafted files, such as email attachments.
• A heap overflow in HFS Plus parsing was combined with an out-of-bounds read in the library used to parse CHM archives.
• The researcher used scan behavior as a side channel to recover a function pointer and bypass address-space randomization.
• For the Zimbra case study, DNS requests during spam checking provided an indirect signal because external senders did not receive scan results.
• The demonstrated exploit took one to two hours in testing and was not optimized, according to Scannell.
• Cisco confirmed that the reported vulnerabilities affected its secure web appliance.

Vendors