Log in Start free

Vulnerability · Published Feb 5, 2020 · Assigned by cisco

CVE-2020-3123

High 7.5

In plain English

A high-severity out-of-bounds read in ClamAV from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.6%top 14.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20clamav0.102.1-r0ALPINE-CVE-2020-3123
Alpine:v3.21clamav0.102.1-r0ALPINE-CVE-2020-3123
Alpine:v3.22clamav0.102.1-r0ALPINE-CVE-2020-3123
Alpine:v3.23clamav0.102.1-r0ALPINE-CVE-2020-3123
Alpine:v3.24clamav0.102.1-r0ALPINE-CVE-2020-3123
Debian:12clamav0.102.2+dfsg-1DEBIAN-CVE-2020-3123
Debian:13clamav0.102.2+dfsg-1DEBIAN-CVE-2020-3123
Debian:14clamav0.102.2+dfsg-1DEBIAN-CVE-2020-3123

Affected products (as reported)

VendorProductVersions
Cisco ClamAV 0.102.1

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References