CVE-2024-20328: ClamAV VirusEvent File Processing Command Injection Vulnerability
A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file name containing command-line sequences. When processed on a system using configuration options for the VirusEvent feature, the attacker could cause the application to execute arbitrary commands. ClamAV has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Other sources
ClamAV VirusEvent File Processing Command Injection Vulnerability
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20328?
CVE-2024-20328 is considered a high severity vulnerability due to its potential for local command injection.
How do I fix CVE-2024-20328?
To fix CVE-2024-20328, upgrade to the latest ClamAV version that is not affected, such as 1.0.6+dfsg-1 for Debian or 1.0.5+dfsg-0ubuntu0.23.10.1 for Ubuntu.
Which systems are affected by CVE-2024-20328?
CVE-2024-20328 affects certain versions of ClamAV on Debian and Ubuntu systems, specifically versions before the patched releases.
What is the impact of CVE-2024-20328?
The impact of CVE-2024-20328 allows a local attacker to execute arbitrary commands with the application's service account privileges.
Can CVE-2024-20328 be exploited remotely?
No, CVE-2024-20328 can only be exploited by a local attacker with access to the system.