Vulnerability Name:

CVE-2004-1876 (CCN-15692)

Assigned:2004-03-30
Published:2004-03-30
Updated:2017-07-11
Summary:The "%f" feature in the VirusEvent directive in Clam AntiVirus daemon (clamd) before 0.70 allows local users to execute arbitrary commands via shell metacharacters in a file name.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: CCN
Type: BugTraq Mailing List, Tue Mar 30 2004 - 06:34:18 CST
clamd - NEVER use "%f" in your "VirusEvent"

Source: MITRE
Type: CNA
CVE-2004-1876

Source: BUGTRAQ
Type: UNKNOWN
20040330 clamd - NEVER use "%f" in your "VirusEvent"

Source: CCN
Type: SA11253
Clam AntiVirus Realtime Scanning VirusEvent Security Issue

Source: SECUNIA
Type: Patch, Vendor Advisory
11253

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200405-03

Source: CCN
Type: GLSA-200405-03
ClamAV VirusEvent parameter vulnerability

Source: CCN
Type: GLSA 200405-03
ClamAV VirusEvent parameter vulnerability

Source: CCN
Type: OSVDB ID: 4759
Clam AntiVirus Realtime Scanning VirusEvent Local Arbitrary Command Execution

Source: BID
Type: Exploit, Patch, Vendor Advisory
10007

Source: CCN
Type: BID-10007
Clam Anti-Virus ClamAV Arbitrary Command Execution Vulnerability

Source: CCN
Type: BID-10008
MPlayer Remote HTTP Header Buffer Overflow Vulnerability

Source: CCN
Type: BID-10009
Oracle Single Sign-On Login Page Authentication Credential Disclosure Vulnerability

Source: CCN
Type: BID-1001
InterAccess TelnetD Server 4.0 Terminal Configuration Vulnerability

Source: CCN
Type: BID-10010
LinBit Technologies LINBOX Officeserver Remote Authentication Bypass Vulnerability

Source: CCN
Type: BID-10013
PHPKit Multiple HTML Injection Vulnerabilities

Source: CCN
Type: BID-10017
JamesOff QuoteEngine Multiple Parameter Unspecified SQL Injection Vulnerability

Source: CCN
Type: BID-10018
MadBMS Unspecified Login Vulnerability

Source: CCN
Type: BID-10019
Cactusoft CactuShop SQL Injection Vulnerability

Source: CCN
Type: BID-1002
Sambar Server Batch CGI Vulnerability

Source: CCN
Type: BID-10020
CactuSoft CactuShop Cross-Site Scripting Vulnerability

Source: CCN
Type: BID-10022
Roger Wilco Server UDP Datagram Handling Denial Of Service Vulnerability

Source: CCN
Type: BID-10024
Roger Wilco Information Disclosure Vulnerability

Source: CCN
Type: BID-10025
Roger Wilco Server Unauthorized Audio Stream Denial Of Service Vulnerability

Source: CCN
Type: BID-10026
ADA IMGSVR Remote Directory Listing Vulnerability

Source: CCN
Type: BID-10027
ADA IMGSVR Remote File Download Vulnerability

Source: CCN
Type: BID-10028
OpenBSD ISAKMPD Zero Payload Length Denial Of Service Vulnerability

Source: CCN
Type: BID-1003
FTPx FTP Explorer Weak Password Encryption Vulnerability

Source: CCN
Type: BID-10033
HAHTsite Scenario Server Project File Name Buffer Overrun Vulnerability

Source: CCN
Type: BID-10036
Macromedia Dreamweaver Remote User Database Access Vulnerability

Source: CCN
Type: BID-10037
SGI IRIX ftpd Multiple Denial Of Service Vulnerabilities

Source: XF
Type: UNKNOWN
clamantivirus-virusevent-gain-privileges(15692)

Source: XF
Type: UNKNOWN
clamantivirus-virusevent-gain-privileges(15692)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:clam_anti-virus:clamav:0.51:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.52:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.53:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.54:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.60:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.65:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.67:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.68:*:*:*:*:*:*:*
  • OR cpe:/a:clam_anti-virus:clamav:0.68.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:clamav:clamav:*:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    clam_anti-virus clamav 0.51
    clam_anti-virus clamav 0.52
    clam_anti-virus clamav 0.53
    clam_anti-virus clamav 0.54
    clam_anti-virus clamav 0.60
    clam_anti-virus clamav 0.65
    clam_anti-virus clamav 0.67
    clam_anti-virus clamav 0.68
    clam_anti-virus clamav 0.68.1
    clamav clamav *
    gentoo linux *