// For flags

CVE-2017-12378

 

Severity Score

5.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.

ClamAV AntiVirus, en versiones 0.99.2 y anteriores, contiene una vulnerabilidad que podría permitir que un atacante remoto sin autenticar provoque una denegación de servicio (DoS) en un sistema afectado. La vulnerabilidad se debe a errores en los mecanismos de comprobación de validación de entradas de archivos .tar (Tape Archive) enviados a un dispositivo afectado. Un exploit con éxito podría provocar una sobrelectura de búfer basada en suma de verificación cuando ClamAV escanea el archivo .tar malicioso, permitiendo que el atacante cree una condición de DoS en el dispositivo afectado.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-08-03 CVE Reserved
  • 2018-01-26 CVE Published
  • 2024-06-12 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-125: Out-of-bounds Read
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 7.0
Search vendor "Debian" for product "Debian Linux" and version "7.0"
-
Affected
Clamav
Search vendor "Clamav"
 Clamav
Search vendor "Clamav" for product "Clamav"
 <= 0.99.2
Search vendor "Clamav" for product "Clamav" and version " <= 0.99.2"
-
Affected