Vulnerability CVE-2020-3327

Vulnerability Name:

CVE-2020-3327 (CCN-181942)

Assigned:

2019-12-12

Published:

2020-05-12

Updated:

2021-09-22

Summary:

A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-20

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2020-3327

Source: CCN
Type: ClamAV Blog, Tuesday, May 12, 2020
ClamAV 0.102.3 security patch released

Source: CISCO
Type: Vendor Advisory
https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html

Source: XF
Type: UNKNOWN
clamav-cve20203327-dos(181942)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20200519 [SECURITY] [DLA 2215-1] clamav security update

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20200806 [SECURITY] [DLA 2314-1] clamav security update

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-b0acd7b66e

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-6584a641ae

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-bca44487a1

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-dd0c20d985

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-d98d2cbae1

Source: GENTOO
Type: Third Party Advisory
GLSA-202007-23

Source: UBUNTU
Type: Third Party Advisory
USN-4370-1

Source: UBUNTU
Type: Third Party Advisory
USN-4370-2

Source: UBUNTU
Type: Third Party Advisory
USN-4435-1

Source: UBUNTU
Type: Third Party Advisory
USN-4435-2

Source: CCN
Type: ClamAV Web site
ClamAV

Vulnerable Configuration:

Configuration 1:

cpe:/a:cisco:clam_antivirus:*:*:*:*:*:*:*:* (Version <= 0.102.2)

Configuration 2:

cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*

OR cpe:/o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Configuration 4:

cpe:/o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

OR cpe:/o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

OR cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

OR cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Configuration CCN 1:

cpe:/a:clamav:clamav:0.102.2:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7463	P	clamav-0.103.8-150000.3.44.1 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:94472	P	(Important)	2022-07-21
oval:org.opensuse.security:def:3189	P	libipa_hbac0-1.16.1-4.17.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3360	P	rzsz-0.12.21~rc-1001.3.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94519	P	clamav-0.103.5-3.35.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:2889	P	clamav-0.103.5-3.35.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:27	P	clamav-0.103.2-3.26.1 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:956	P	Security update for expat (Important)	2022-03-04
oval:org.opensuse.security:def:112078	P	clamav-0.103.3-1.4 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:105621	P	clamav-0.103.3-1.4 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:96753	P	python3-Jinja2-2.10.1-3.5.1 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:100803	P	clamav-0.103.2-3.26.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62045	P	clamav-0.103.2-3.26.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101185	P	libcdio16-0.94-6.9.2 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:71786	P	clamav-0.103.2-3.26.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:38102	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:44491	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:38764	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:45660	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:40061	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:43194	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:41230	P	Security update for clamav (Moderate)	2021-01-05
oval:org.opensuse.security:def:32837	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:82081	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:23876	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:55787	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:89105	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:84540	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:31099	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:21360	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:58660	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:127078	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:51864	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:87301	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:33627	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:82518	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:28874	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:56922	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:89363	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:85563	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:31569	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:23110	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:59450	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:54697	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:88090	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:33885	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:83171	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:29311	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:57392	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:125509	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:51098	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:86033	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:32019	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:81033	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:23496	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:59708	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:55134	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:88399	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:84085	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:29964	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:57842	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:126681	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:51484	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:86483	P	Security update for clamav (Important)	2020-12-22
oval:org.opensuse.security:def:110920	P	Security update for clamav (Moderate)	2020-12-18
oval:org.opensuse.security:def:110374	P	Security update for clamav (Moderate)	2020-12-17
oval:org.opensuse.security:def:90427	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:73400	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:117366	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:104082	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:73571	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:64278	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:97392	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:107851	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:64449	P	Security update for clamav (Moderate)	2020-12-14
oval:org.opensuse.security:def:60153	P	Security update for clamav (Important)	2020-12-09
oval:org.opensuse.security:def:34330	P	Security update for clamav (Important)	2020-12-09

BACK