-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:043
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : clamav
 Date    : February 19, 2007
 Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 Clam AntiVirus ClamAV before 0.90 does not close open file descriptors
 under certain conditions, which allows remote attackers to cause a
 denial of service (file descriptor consumption and failed scans) via
 CAB archives with a cabinet header record length of zero, which causes
 a function to return without closing a file descriptor. (CVE-2007-0897)
 
 Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV
 before 0.90 allows remote attackers to overwrite arbitrary files via a
 .. (dot dot) in the id MIME header parameter in a multi-part message.
 (CVE-2007-0898)
 
 The update to 0.90 addresses these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0897
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0898
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 d478e8184aac28373be2bd287cbeae73  2006.0/i586/clamav-0.90-0.1.20060mdk.i586.rpm
 fd08410e04bfac99c4ebb3423f8a212f  2006.0/i586/clamav-db-0.90-0.1.20060mdk.i586.rpm
 26e74832cb99e2284f06debabea7a163  2006.0/i586/clamav-milter-0.90-0.1.20060mdk.i586.rpm
 49c12cdd69b9ff06f2c3f382ef9424f5  2006.0/i586/clamd-0.90-0.1.20060mdk.i586.rpm
 e8671b979de6801bf6a9f88f2f514aa3  2006.0/i586/libclamav1-0.90-0.1.20060mdk.i586.rpm
 484447c8ce4d5d0a38940df71ac181fc  2006.0/i586/libclamav1-devel-0.90-0.1.20060mdk.i586.rpm 
 73b2ff74a1eab49ecc30e8f4fb247bf2  2006.0/SRPMS/clamav-0.90-0.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 d0358166c006dc52593c58a00335ede6  2006.0/x86_64/clamav-0.90-0.1.20060mdk.x86_64.rpm
 b7b96b59800f61f9772c8ff5d2c1e174  2006.0/x86_64/clamav-db-0.90-0.1.20060mdk.x86_64.rpm
 c0c59ceed196d27d9f6cf957197c82c5  2006.0/x86_64/clamav-milter-0.90-0.1.20060mdk.x86_64.rpm
 212ca37f1506c9283a7a47a94b05761c  2006.0/x86_64/clamd-0.90-0.1.20060mdk.x86_64.rpm
 0e807be53a70992133fffcace4ecaba9  2006.0/x86_64/lib64clamav1-0.90-0.1.20060mdk.x86_64.rpm
 ebd04ff90f10621837c1fcddb357293c  2006.0/x86_64/lib64clamav1-devel-0.90-0.1.20060mdk.x86_64.rpm 
 73b2ff74a1eab49ecc30e8f4fb247bf2  2006.0/SRPMS/clamav-0.90-0.1.20060mdk.src.rpm

 Mandriva Linux 2007.0:
 05b57b655873d037cd93ecef3f439e4a  2007.0/i586/clamav-0.90-1.1mdv2007.0.i586.rpm
 4c894ca77de3bb764bf001df5fe456d0  2007.0/i586/clamav-db-0.90-1.1mdv2007.0.i586.rpm
 a79763ed46f52df012cda91ae15c24bc  2007.0/i586/clamav-milter-0.90-1.1mdv2007.0.i586.rpm
 ac617c55ee7fc187bb763b4f422b45f4  2007.0/i586/clamd-0.90-1.1mdv2007.0.i586.rpm
 1f560e10b9f5263a406b5682f8df20b3  2007.0/i586/libclamav1-0.90-1.1mdv2007.0.i586.rpm
 83492cb6e36b01f82c3772270af81d71  2007.0/i586/libclamav1-devel-0.90-1.1mdv2007.0.i586.rpm 
 e14099005151cb6cd06527348ea9f5f2  2007.0/SRPMS/clamav-0.90-1.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 833fa03ec7207b9908c0b3fca554dd49  2007.0/x86_64/clamav-0.90-1.1mdv2007.0.x86_64.rpm
 29909e2d73531f75750c02c025f91dcb  2007.0/x86_64/clamav-db-0.90-1.1mdv2007.0.x86_64.rpm
 2527cf8b432dc7b5ad6ba3fd427724bd  2007.0/x86_64/clamav-milter-0.90-1.1mdv2007.0.x86_64.rpm
 fc2b6a8a934e88d93debdd644f4eefef  2007.0/x86_64/clamd-0.90-1.1mdv2007.0.x86_64.rpm
 ee89752f5b5875e5ac5afd7ad4293b32  2007.0/x86_64/lib64clamav1-0.90-1.1mdv2007.0.x86_64.rpm
 81d17f067619437526190b953e0c5206  2007.0/x86_64/lib64clamav1-devel-0.90-1.1mdv2007.0.x86_64.rpm 
 e14099005151cb6cd06527348ea9f5f2  2007.0/SRPMS/clamav-0.90-1.1mdv2007.0.src.rpm

 Corporate 3.0:
 ad2dff0bec17856884d0ccecc18df652  corporate/3.0/i586/clamav-0.90-0.1.C30mdk.i586.rpm
 cb9cca92b34fb2e6e5709f4d9b3de0ad  corporate/3.0/i586/clamav-db-0.90-0.1.C30mdk.i586.rpm
 c8b968b8629b8d422c5aeef49da5fab2  corporate/3.0/i586/clamav-milter-0.90-0.1.C30mdk.i586.rpm
 a10a5abcea78a66e11b8e2e8dfb8fa04  corporate/3.0/i586/clamd-0.90-0.1.C30mdk.i586.rpm
 0b1cd6e53f293f2d143fa0e79fd4cc8b  corporate/3.0/i586/libclamav1-0.90-0.1.C30mdk.i586.rpm
 232b55ab3ffc888aca0d2a1915a8b106  corporate/3.0/i586/libclamav1-devel-0.90-0.1.C30mdk.i586.rpm 
 b19bb5df0c8520ddfa501beac3b12381  corporate/3.0/SRPMS/clamav-0.90-0.1.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 2800e661cd096538f393c8eed9cbe6e2  corporate/3.0/x86_64/clamav-0.90-0.1.C30mdk.x86_64.rpm
 dfe0fc52a7f9efc5fd2be2e525996414  corporate/3.0/x86_64/clamav-db-0.90-0.1.C30mdk.x86_64.rpm
 591678a80c4d873b9dbd3045f4b837cb  corporate/3.0/x86_64/clamav-milter-0.90-0.1.C30mdk.x86_64.rpm
 59e310e76b51ce87e9c3d2eba11b41f8  corporate/3.0/x86_64/clamd-0.90-0.1.C30mdk.x86_64.rpm
 954ba4e79a8e259583c236d1e8922559  corporate/3.0/x86_64/lib64clamav1-0.90-0.1.C30mdk.x86_64.rpm
 cc685b342368205402fd7e33dbb8ed0c  corporate/3.0/x86_64/lib64clamav1-devel-0.90-0.1.C30mdk.x86_64.rpm 
 b19bb5df0c8520ddfa501beac3b12381  corporate/3.0/SRPMS/clamav-0.90-0.1.C30mdk.src.rpm

 Corporate 4.0:
 e50bb43342dd1406dbf6066827e898fb  corporate/4.0/i586/clamav-0.90-0.1.20060mlcs4.i586.rpm
 b0c3b10edb2e890a713598f565a13555  corporate/4.0/i586/clamav-db-0.90-0.1.20060mlcs4.i586.rpm
 b54c220f936aac40dff2a784637884d9  corporate/4.0/i586/clamav-milter-0.90-0.1.20060mlcs4.i586.rpm
 e5c2f70f08edd228c352aa4349a43582  corporate/4.0/i586/clamd-0.90-0.1.20060mlcs4.i586.rpm
 1aa94968f937436a168d9b33c3046fcc  corporate/4.0/i586/libclamav1-0.90-0.1.20060mlcs4.i586.rpm
 5c9a6917fc3b83c7a96d24532df37351  corporate/4.0/i586/libclamav1-devel-0.90-0.1.20060mlcs4.i586.rpm 
 772099a75eb5a6ee2949af173b9e1b51  corporate/4.0/SRPMS/clamav-0.90-0.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 76a2be1b4cf681342a3d5993f330e189  corporate/4.0/x86_64/clamav-0.90-0.1.20060mlcs4.x86_64.rpm
 5e17ee07795168e109e6956ef98348d3  corporate/4.0/x86_64/clamav-db-0.90-0.1.20060mlcs4.x86_64.rpm
 6d361ea87425a4b297e6245eee216a30  corporate/4.0/x86_64/clamav-milter-0.90-0.1.20060mlcs4.x86_64.rpm
 a0ee52c4f866b104bc89a337ae4a5fb4  corporate/4.0/x86_64/clamd-0.90-0.1.20060mlcs4.x86_64.rpm
 5f81def8296e37bc2a9a1aa818431362  corporate/4.0/x86_64/lib64clamav1-0.90-0.1.20060mlcs4.x86_64.rpm
 580883088be552b2c9eea7634e16622f  corporate/4.0/x86_64/lib64clamav1-devel-0.90-0.1.20060mlcs4.x86_64.rpm 
 772099a75eb5a6ee2949af173b9e1b51  corporate/4.0/SRPMS/clamav-0.90-0.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFF2f2dmqjQ0CJFipgRAhcYAKDH7nCgtpr2+ERlA30qBBgU/NPn2ACgyEDd
9e/Pl3onopRJ8c78hGD/QT4=
=ou04
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/