CVE-2019-1785 Clam AntiVirus RAR Directory Traversal Vulnerability
Remote attackers can cause denial of service and read or write arbitrary files via crafted RAR archives in ClamAV.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1785?
CVE-2019-1785 is a critical path traversal vulnerability in Clamav Clamav, published on 8 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.
Which versions are affected by CVE-2019-1785?
It affects 1 product.
Products include Clamav Clamav.
How do I fix CVE-2019-1785?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-1785 being exploited?
There is no known exploitation of CVE-2019-1785 in the wild and no public exploit code.
Other vulnerabilities in Clamav Clamav
Sources
Also known as DEBIAN-CVE-2019-1785, GHSA-qx8r-9782-gh9f.