This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐ฆ **Affected**: ClamAV versions **prior to 0.91.2**. ๐ง **Component**: Specifically the `clamav-milter` service when operating in **Black Hole Mode**. ๐ข **Vendor**: ClamAV Project.
Q4What can hackers do? (Privileges/Data)
๐ **Hackers' Power**: Execute **arbitrary system commands** with the privileges of the service user (often root or mail user). ๐ **Impact**: Full server compromise, data theft, or lateral movement. ๐ต๏ธโโ๏ธ
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **LOW**. ๐ **Auth**: No authentication required; exploits via standard **SMTP RCPT TO** headers. โ๏ธ **Config**: Requires the target to be running ClamAV Milter in Black Hole Mode. ๐ก
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฃ **Public Exp**: **YES**. ๐ **PoC**: Python-based RCE exploits available on GitHub (e.g., `0x1sac`, `strikoder`). ๐ **Status**: Wild exploitation is possible due to simple SMTP vector. ๐ฉ
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for ClamAV Milter services. ๐ **Verify**: Check version number (`clamav-milter -v`). ๐ซ **Flag**: If version < 0.91.2 and Black Hole Mode is active, you are vulnerable. ๐
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: **YES**. ๐ฆ **Patch**: Upgrade to **ClamAV 0.91.2** or later. ๐ **Advisories**: Debian DSA-1366, Mandriva MDKSA-2007:172, Fedora FEDORA-2007-2050. ๐
Q9What if no patch? (Workaround)
๐ **Workaround**: Disable **Black Hole Mode** if not strictly necessary. ๐ซ **Filter**: Implement strict input validation on SMTP headers at the gateway level.โฆ