CVE-2018-0202 PoC — ClamAV clamscan 安全漏洞

Source

https://github.com/jaychowjingjie/CVE-2018-0202

Associated Vulnerability

Title:ClamAV clamscan 安全漏洞 (CVE-2018-0202)
Description:clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400.

Description

Security & Privacy in Computing(Fall 2018), Final Group Project at JHUISI, clamscan vulnerability in Cisco's ClamAV 0.99.3

Readme

# CVE-2018-0202
Security & Privacy in Computing(Fall 2018) Final Group Project, clamscan vulnerability in Cisco's ClamAV 0.99.3
Members: Jay Chow, Harry Luo, Benfang Wang, Johns Hopkins University Information Security Institute

Detailed steps on how we installed this vulnerable version of ClamAV 0.9.33:

1)From https://www.clamav.net/downloads, we scrolled down and went to Previous Stable Releases -> clamav-0.99.3 and downloaded clamav-0.99.3.tar.gz(since the vulnerable versions are before 0.99.4.

2)After downloading this .tar.gz, we extracted the folder and clicked on INSTALL found within the clamav-0.99.3.

3)We ran “./configure” within the folder clamav-0.99.3.

4)We ran “make” within the folder clamav-0.99.3. This took some time.

5)We ran  “sudo make install” within the folder clamav-0.99.3.

6)Then within clamav-0.99.3/clamscan, we got clamscan, which a shell script, ready for usage.

7)Finally, we could run clamscan by "sudo clamscan <sample.pdf>".

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!