oss-security - CVE-2015-2221: clamav: infinite loop condition on crafted y0da cryptor file

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 3 May 2015 18:24:00 +0200
From: Sebastian Andrzej Siewior <cve-announce@...breakpoint.cc>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-2221: clamav: infinite loop condition on crafted y0da
 cryptor file

Y0da cryptor / protector is a PE file encryptor - the executable file is
decrypted on start up. Clamav [0] is able to decrypt such files in order to
scan them. As part of the decryptor there is an op code emulator. A special
crafted file may contain a jump op code to a position that already has been
interpreted - which leads to an endless loop. This leads to an endless loop in
clamav itself.

This has been fixed by [1] and the loop limit has been increased in [2]. This
change is part of the 0.98.7 release.

This bug has been discovered by AFL [3], american fuzzy lop.

[0] http://www.clamav.net/
[1] https://github.com/vrtadmin/clamav-devel/commit/0844d0cfe118b4041ed8e2ee49ff18bfbca8eaa5
[2] https://github.com/vrtadmin/clamav-devel/commit/26b19809fb3b940cb0fda0422d685fff02a53b5f
[3] http://lcamtuf.coredump.cx/afl/

Sebastian

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.