CVE-2007-2650: Medium severity clamav clamav vulnerability
Published May 14, 2007
·Updated
The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop, as demonstrated via a crafted DOC file.
Affected Software
3 affected components
clamav clamav<0.90.3
Debian Debian Linux=3.1
Debian Debian Linux=4.0
Remediation
Patch Available
Event History
May 14, 2007
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2650?
CVE-2007-2650 has a severity rating of moderate due to its potential for causing denial of service.
2
How do I fix CVE-2007-2650?
To fix CVE-2007-2650, upgrade to ClamAV version 0.90.3 or later.
3
What are the main vulnerabilities associated with CVE-2007-2650?
CVE-2007-2650 allows for denial of service through large property sizes in OLE2 files or loops in the FAT file block chain.
4
Which versions of ClamAV are affected by CVE-2007-2650?
CVE-2007-2650 affects ClamAV versions prior to 0.90.3.
5
Can a crafted DOC file exploit CVE-2007-2650?
Yes, a crafted DOC file can exploit CVE-2007-2650 by triggering resource consumption and potentially causing an infinite loop.