ClamAV is a popular toolkit for Unix-like operating systems and is mainly deployed to secure email exchange servers.
According to the SANS Internet Storm Center, the more serious of two bugs is related to the handling of PE (portable executable) file format. The other vulnerability is caused by a memory access error in CHM, the file extension for compressed HTML help files, according to Secunia, which has labeled both flaws "highly critical."
For attackers to exploit the two bugs, they must send "specially constructed executable files through a mail gateway or personal anti-virus client utilizing the ClamAV scanning engine."
Users who upgrade to version 0.88.5 should avoid problems. William Salusky, a SANS handler, said in a blog post Monday that alternatively, users could download release candidate v0.90RC1 from the ClamAV site.
Click here to email Dan Kaplan.
ClamAV update patches two vulnerabilities
ClamAV users are urged to upgrade to the latest version to correct two vulnerabilities that could crash the free, open-source anti-virus toolkit and lead to an attacker hijacking infected systems.
Add iTnews as your trusted source
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
.png&h=140&w=231&c=1&s=0)
Partner Content
Is your website a commercial risk (and why it could be without you realising it)?
.jpg&h=140&w=231&c=1&s=0)
Promoted Content
Protecting the Human Operating System: How Technology Teams Can Perform Under Pressure in an Always-On World
iTnews State of Security Breakfast comes to Sydney
.png&h=140&w=231&c=1&s=0)
Promoted Content
From ambition to impact: The next era of government transformation.
.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC
.png&h=140&w=231&c=1&s=0)
.png&h=140&w=231&c=1&s=0)
