| Vulnerability Name: | CVE-2007-2650 (CCN-34274) | ||||||||||||||||
| Assigned: | 2007-04-18 | ||||||||||||||||
| Published: | 2007-04-18 | ||||||||||||||||
| Updated: | 2020-11-09 | ||||||||||||||||
| Summary: | The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop, as demonstrated via a crafted DOC file. | ||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
| ||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P) 3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||
| Vulnerability Type: | CWE-400 | ||||||||||||||||
| Vulnerability Consequences: | Denial of Service | ||||||||||||||||
| References: | Source: MISC Type: Broken Link http://article.gmane.org/gmane.comp.security.virus.clamav.devel/2853 Source: MITRE Type: CNA CVE-2007-2650 Source: CONFIRM Type: Broken Link http://kolab.org/security/kolab-vendor-notice-15.txt Source: MLIST Type: Broken Link [clamav-devel] 20070418 Bug in OLE2 file parser Source: CCN Type: gmane.comp.security.virus.clamav.devel, 2007-04-18 11:12:10 GMT Bug in OLE2 file parser Source: CCN Type: SA25244 ClamAV Multiple Vulnerabilities Source: SECUNIA Type: Patch, Third Party Advisory 25244 Source: SECUNIA Type: Third Party Advisory 25523 Source: CCN Type: SA25525 Kolab Server ClamAV Denial of Service Source: SECUNIA Type: Third Party Advisory 25525 Source: SECUNIA Type: Third Party Advisory 25553 Source: SECUNIA Type: Third Party Advisory 25558 Source: SECUNIA Type: Third Party Advisory 25688 Source: SECUNIA Type: Third Party Advisory 25796 Source: GENTOO Type: Third Party Advisory GLSA-200706-05 Source: CCN Type: SourceForge.net Clam AntiVirus Source: CONFIRM Type: Broken Link http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog Source: DEBIAN Type: Third Party Advisory DSA-1320 Source: DEBIAN Type: DSA-1320 clamav -- several vulnerabilities Source: CCN Type: GLSA-200706-05 ClamAV: Multiple Denials of Service Source: MANDRIVA Type: Third Party Advisory MDKSA-2007:115 Source: SUSE Type: Third Party Advisory SUSE-SA:2007:033 Source: CCN Type: OSVDB ID: 34915 Clam AntiVirus OLE2 Parser Malformed File Handling DoS Source: BID Type: Third Party Advisory, VDB Entry 24316 Source: CCN Type: BID-24316 Clam AntiVirus ClamAV OLE2 Parser Remote Denial Of Service Vulnerability Source: TRUSTIX Type: Broken Link 2007-0020 Source: VUPEN Type: Permissions Required ADV-2007-1776 Source: XF Type: UNKNOWN clamav-ole2-dos(34274) Source: SUSE Type: SUSE-SA:2007:033 clamav 0.90.3 update | ||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2:  Denotes that component is vulnerable | ||||||||||||||||
| Oval Definitions | |||||||||||||||||
| |||||||||||||||||
| BACK | |||||||||||||||||