Date: Sun, 3 May 2015 18:24:00 +0200 From: Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc> To: oss-security@...ts.openwall.com Subject: CVE-2015-2221: clamav: infinite loop condition on crafted y0da cryptor file Y0da cryptor / protector is a PE file encryptor - the executable file is decrypted on start up. Clamav  is able to decrypt such files in order to scan them. As part of the decryptor there is an op code emulator. A special crafted file may contain a jump op code to a position that already has been interpreted - which leads to an endless loop. This leads to an endless loop in clamav itself. This has been fixed by  and the loop limit has been increased in . This change is part of the 0.98.7 release. This bug has been discovered by AFL , american fuzzy lop.  http://www.clamav.net/  https://github.com/vrtadmin/clamav-devel/commit/0844d0cfe118b4041ed8e2ee49ff18bfbca8eaa5  https://github.com/vrtadmin/clamav-devel/commit/26b19809fb3b940cb0fda0422d685fff02a53b5f  http://lcamtuf.coredump.cx/afl/ Sebastian
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ