Cisco fixed critical RCE bug in ClamAV Open-Source Antivirus engine

Cisco addressed a critical vulnerability in the ClamAV open source antivirus engine that can lead to remote code execution on vulnerable devices.

Cisco fixed a critical flaw, tracked as CVE-2023-20032 (CVSS score: 9.8), in the ClamAV open source antivirus engine. The vulnerability resides in the residing in the HFS+ file parser component, an attacker can trigger the issue to gain remote code execution on vulnerable devices or trigger a DoS condition.

Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser.

The vulnerability affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. The company acknowledged Simon Scannell from Google for reporting this issue.

The vulnerability is a buffer overflow issue affecting the ClamAV scanning library, it is due to a missing buffer size check.

“This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device.” reads the advisory published by Cisco. “A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.”

The vulnerability affects the following products:

Cisco Product	Cisco Bug ID	Fixed Release Availability
Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Linux	CSCwd74133	1.20.21
Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for MacOS	CSCwd74134	1.21.11
Secure Endpoint, formerly Advanced Malware Protection (AMP) for Endpoints, for Windows	CSCwd74135	7.5.9 1 8.1.5
Secure Endpoint Private Cloud	CSCwe18204	3.6.0 or later with updated connectors2
Secure Web Appliance, formerly Web Security Appliance	CSCwd74132	14.0.4-005 15.0.0-254

Secure Email Gateway, formerly Email Security Appliance, and Secure Email and Web Manager, formerly Security Management Appliance, are not impacted.

The IT giant says that there is not workaround for this vulnerability, the good news is that the company Product Security Incident Response Team (PSIRT) is not aware of attacks in the wild exploiting this vulnerability.

Cisco also addressed another vulnerability, tracked as CVE-2023-20052, in the ClamAV engine. The flaw is a possible remote information leak vulnerability in the DMG file parser.

The vulnerability affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.

“This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device.” reads the advisory. “A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ClamAV)