Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Clam Anti-Virus ClamAV本地任意命令执行漏洞
Vulnerability Description
Clam Antivirus (clamav)是一款基于UNIX的病毒扫描程序。 ClamAV在部分配置下存在安全问题，本地攻击者可以利用这个漏洞以Root权限在系统上执行任意命令。 当'clamav.conf'配置文件中包含'VirusEvent'(默认不开启)，防病毒软件使用了'Dazuko'模块时，发现病毒时，在命令字符串中%v和%f会被病毒名及受感染文件名代替，但是代码没有过滤一些Shell字符如";"或"，因此如果建立一个名为" ; chmod 777 etc"的文件并加入病毒，可导致以root
CVSS Information
N/A
Vulnerability Type
N/A