NVD脆弱性詳細

CVE-2010-1311

概要	The qtm_decompress function in libclamav/mspack.c in ClamAV before 0.96 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted CAB archive that uses the Quantum (aka .Q) compression format. NOTE: some of these details are obtained from third party information.
公表日	2010年4月9日2:30
登録日	2021年1月29日10:59
最終更新日	2023年11月7日11:05

CVSS2.0 : MEDIUM
スコア	5.0
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:clamav:clamav:0.95.2:::::::*
cpe:2.3:a:clamav:clamav:0.86.2:::::::*
cpe:2.3:a:clamav:clamav:0.88.5:::::::*
cpe:2.3:a:clamav:clamav:0.02:::::::*
cpe:2.3:a:clamav:clamav:0.92:::::::*
cpe:2.3:a:clamav:clamav:0.95:rc2::::::
cpe:2.3:a:clamav:clamav:0.15:::::::*
cpe:2.3:a:clamav:clamav:0.90:rc2::::::
cpe:2.3:a:clamav:clamav:0.75.1:::::::*
cpe:2.3:a:clamav:clamav:0.65:::::::*
cpe:2.3:a:clamav:clamav:0.88.7:::::::*
cpe:2.3:a:clamav:clamav:0.81:::::::*
cpe:2.3:a:clamav:clamav:0.86:::::::*
cpe:2.3:a:clamav:clamav:0.01:::::::*
cpe:2.3:a:clamav:clamav:0.85:::::::*
cpe:2.3:a:clamav:clamav:0.84:::::::*
cpe:2.3:a:clamav:clamav:0.3:::::::*
cpe:2.3:a:clamav:clamav:0.93.1:::::::*
cpe:2.3:a:clamavs:clamav:0.04:::::::*
cpe:2.3:a:clamav:clamav:0.90:rc1.1::::::
cpe:2.3:a:clamav:clamav:0.95.1:::::::*
cpe:2.3:a:clamav:clamav:0.93:::::::*
cpe:2.3:a:clamav:clamav:0.90:::::::*
cpe:2.3:a:clamav:clamav:0.70:rc::::::
cpe:2.3:a:clamav:clamav:0.86:rc1::::::
cpe:2.3:a:clamav:clamav:0.68.1:::::::*
cpe:2.3:a:clamav:clamav:0.03:::::::*
cpe:2.3:a:clamav:clamav:0.87.1:::::::*
cpe:2.3:a:clamav:clamav:0.9:rc1::::::
cpe:2.3:a:clamav:clamav:0.74:::::::*
cpe:2.3:a:clamav:clamav:0.93.3:::::::*
cpe:2.3:a:clamav:clamav:0.88:::::::*
cpe:2.3:a:clamav:clamav:0.91:rc1::::::
cpe:2.3:a:clamav:clamav:0.86.1:::::::*
cpe:2.3:a:clamav:clamav:0.71:::::::*
cpe:2.3:a:clamav:clamav:0.88.1:::::::*
cpe:2.3:a:clamav:clamav:0.60p:::::::*
cpe:2.3:a:clamav:clamav:0.94:::::::*
cpe:2.3:a:clamav:clamav:0.80:rc::::::
cpe:2.3:a:clamav:clamav:0.91.2:::::::*
cpe:2.3:a:clamav:clamav:0.90.3:::::::*
cpe:2.3:a:clamav:clamav:0.85.1:::::::*
cpe:2.3:a:clamav:clamav:0.90:rc1::::::
cpe:2.3:a:clamav:clamav:0.13:::::::*
cpe:2.3:a:clamav:clamav:0.10:::::::*
cpe:2.3:a:clamav:clamav:0.94.2:::::::*
cpe:2.3:a:clamav:clamav:0.80:rc3::::::
cpe:2.3:a:clamav:clamav:0.12:::::::*
cpe:2.3:a:clamav:clamav:0.23:::::::*
cpe:2.3:a:clamav:clamav:0.84:rc1::::::
cpe:2.3:a:clamav:clamav:0.80:rc2::::::
cpe:2.3:a:clamav:clamav:0.95:::::::*
cpe:2.3:a:clamav:clamav:0.60:::::::*
cpe:2.3:a:clamav:clamav:0.88.2:::::::*
cpe:2.3:a:clamav:clamav:0.83:::::::*
cpe:2.3:a:clamav:clamav:0.20:::::::*
cpe:2.3:a:clamav:clamav:0.80:rc4::::::
cpe:2.3:a:clamav:clamav:0.90:rc3::::::
cpe:2.3:a:clamav:clamav:0.70:::::::*
cpe:2.3:a:clamav:clamav:0.88.4:::::::*
cpe:2.3:a:clamav:clamav:0.14:::::::*
cpe:2.3:a:clamav:clamav:0.24:::::::*
cpe:2.3:a:clamav:clamav:0.66:::::::*
cpe:2.3:a:clamav:clamav:0.51:::::::*
cpe:2.3:a:clamav:clamav:0.52:::::::*
cpe:2.3:a:clamav:clamav:0.22:::::::*
cpe:2.3:a:clamav:clamav:0.72:::::::*
cpe:2.3:a:clamav:clamav:0.95:rc1::::::
cpe:2.3:a:clamavs:clamav:0.06:::::::*
cpe:2.3:a:clamav:clamav:0.91:rc2::::::
cpe:2.3:a:clamav:clamav:0.75:::::::*
cpe:2.3:a:clamav:clamav:0.05:::::::*
cpe:2.3:a:clamav:clamav:0.91:::::::*
cpe:2.3:a:clamav:clamav:0.54:::::::*
cpe:2.3:a:clamav:clamav:0.96:rc1::::::
cpe:2.3:a:clamav:clamav:0.80:::::::*
cpe:2.3:a:clamav:clamav::rc2::::::*		0.96
cpe:2.3:a:clamav:clamav:0.87:::::::*
cpe:2.3:a:clamav:clamav:0.21:::::::*
cpe:2.3:a:clamav:clamav:0.84:rc2::::::
cpe:2.3:a:clamav:clamav:0.67-1:::::::*
cpe:2.3:a:clamav:clamav:0.14:pre::::::
cpe:2.3:a:clamav:clamav:0.90.1:::::::*
cpe:2.3:a:clamav:clamav:0.91.1:::::::*
cpe:2.3:a:clamav:clamav:0.95.3:::::::*
cpe:2.3:a:clamav:clamav:0.88.3:::::::*
cpe:2.3:a:clamav:clamav:0.67:::::::*
cpe:2.3:a:clamav:clamav:0.92.1:::::::*
cpe:2.3:a:clamav:clamav:0.90.2:::::::*
cpe:2.3:a:clamav:clamav:0.68:::::::*
cpe:2.3:a:clamav:clamav:0.53:::::::*
cpe:2.3:a:clamav:clamav:0.93.2:::::::*
cpe:2.3:a:clamav:clamav:0.88.6:::::::*
cpe:2.3:a:clamav:clamav:0.94.1:::::::*
cpe:2.3:a:clamav:clamav:0.82:::::::*
cpe:2.3:a:clamav:clamav:0.73:::::::*

関連情報、対策とツール

No	URL	refsource	タグ
1	https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1771	CONFIRM
2	http://secunia.com/advisories/39329	SECUNIA	Vendor Advisory
3	http://www.securityfocus.com/bid/39262	BID	Patch
4	http://www.vupen.com/english/advisories/2010/0827	VUPEN
5	http://secunia.com/advisories/39293	SECUNIA
6	http://www.vupen.com/english/advisories/2010/0832	VUPEN
7	http://www.ubuntu.com/usn/USN-926-1	UBUNTU
8	http://www.vupen.com/english/advisories/2010/0909	VUPEN
9	http://www.mandriva.com/security/advisories?name=MDVSA-2010:082	MANDRIVA
10	http://www.vupen.com/english/advisories/2010/1001	VUPEN
11	http://secunia.com/advisories/39656	SECUNIA
12	http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html	SUSE
13	http://www.vupen.com/english/advisories/2010/1206	VUPEN
14	http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html	APPLE
15	http://support.apple.com/kb/HT4312	CONFIRM
16	http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=clamav-0.96

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN脆弱性情報

ClamAV の libclamav/mspack.c における qtm_decompress 関数におけるサービス運用妨害 (DoS) の脆弱性

タイトル	ClamAV の libclamav/mspack.c における qtm_decompress 関数におけるサービス運用妨害 (DoS) の脆弱性
概要	ClamAV の libclamav/mspack.c における qtm_decompress 関数には、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。
想定される影響	第三者により、巧妙に細工された Quantum 圧縮ファーマットの CAB アーカイブを介し、サービス運用妨害 (DoS) 状態にされる脆弱性が存在します。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2010年4月8日0:00
登録日	2010年9月8日15:52
最終更新日	2010年9月8日15:52

影響を受けるシステム

アップル

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6.4

ClamAV

ClamAV 0.96未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-1311	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1311
National Vulnerability Database (NVD)
2	CVE-2010-1311	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1311

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	名前	URL
Apple Security Updates
1	HT4312	http://support.apple.com/kb/HT4312
Apple セキュリティアップデート
2	HT4312	http://support.apple.com/kb/HT4312?viewlocale=ja_JP
ClamAV
3	Bugzilla Bug 1771	https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1771

その他

No	名前	URL
Secunia Advisory
1	SA39329	http://secunia.com/advisories/39329
SecurityFocus
2	39262	http://www.securityfocus.com/bid/39262
VUPEN Security
3	VUPEN/ADV-2010-0827	http://www.vupen.com/english/advisories/2010/0827

変更履歴

No	変更内容	変更日
0	[2010年09月08日] 掲載	2018年2月17日10:37

構成1	以上	以下	より上	未満
cpe:2.3:a:clamav:clamav:0.95.2:::::::*
cpe:2.3:a:clamav:clamav:0.86.2:::::::*
cpe:2.3:a:clamav:clamav:0.88.5:::::::*
cpe:2.3:a:clamav:clamav:0.02:::::::*
cpe:2.3:a:clamav:clamav:0.92:::::::*
cpe:2.3:a:clamav:clamav:0.95:rc2::::::
cpe:2.3:a:clamav:clamav:0.15:::::::*
cpe:2.3:a:clamav:clamav:0.90:rc2::::::
cpe:2.3:a:clamav:clamav:0.75.1:::::::*
cpe:2.3:a:clamav:clamav:0.65:::::::*
cpe:2.3:a:clamav:clamav:0.88.7:::::::*
cpe:2.3:a:clamav:clamav:0.81:::::::*
cpe:2.3:a:clamav:clamav:0.86:::::::*
cpe:2.3:a:clamav:clamav:0.01:::::::*
cpe:2.3:a:clamav:clamav:0.85:::::::*
cpe:2.3:a:clamav:clamav:0.84:::::::*
cpe:2.3:a:clamav:clamav:0.3:::::::*
cpe:2.3:a:clamav:clamav:0.93.1:::::::*
cpe:2.3:a:clamavs:clamav:0.04:::::::*
cpe:2.3:a:clamav:clamav:0.90:rc1.1::::::
cpe:2.3:a:clamav:clamav:0.95.1:::::::*
cpe:2.3:a:clamav:clamav:0.93:::::::*
cpe:2.3:a:clamav:clamav:0.90:::::::*
cpe:2.3:a:clamav:clamav:0.70:rc::::::
cpe:2.3:a:clamav:clamav:0.86:rc1::::::
cpe:2.3:a:clamav:clamav:0.68.1:::::::*
cpe:2.3:a:clamav:clamav:0.03:::::::*
cpe:2.3:a:clamav:clamav:0.87.1:::::::*
cpe:2.3:a:clamav:clamav:0.9:rc1::::::
cpe:2.3:a:clamav:clamav:0.74:::::::*
cpe:2.3:a:clamav:clamav:0.93.3:::::::*
cpe:2.3:a:clamav:clamav:0.88:::::::*
cpe:2.3:a:clamav:clamav:0.91:rc1::::::
cpe:2.3:a:clamav:clamav:0.86.1:::::::*
cpe:2.3:a:clamav:clamav:0.71:::::::*
cpe:2.3:a:clamav:clamav:0.88.1:::::::*
cpe:2.3:a:clamav:clamav:0.60p:::::::*
cpe:2.3:a:clamav:clamav:0.94:::::::*
cpe:2.3:a:clamav:clamav:0.80:rc::::::
cpe:2.3:a:clamav:clamav:0.91.2:::::::*
cpe:2.3:a:clamav:clamav:0.90.3:::::::*
cpe:2.3:a:clamav:clamav:0.85.1:::::::*
cpe:2.3:a:clamav:clamav:0.90:rc1::::::
cpe:2.3:a:clamav:clamav:0.13:::::::*
cpe:2.3:a:clamav:clamav:0.10:::::::*
cpe:2.3:a:clamav:clamav:0.94.2:::::::*
cpe:2.3:a:clamav:clamav:0.80:rc3::::::
cpe:2.3:a:clamav:clamav:0.12:::::::*
cpe:2.3:a:clamav:clamav:0.23:::::::*
cpe:2.3:a:clamav:clamav:0.84:rc1::::::
cpe:2.3:a:clamav:clamav:0.80:rc2::::::
cpe:2.3:a:clamav:clamav:0.95:::::::*
cpe:2.3:a:clamav:clamav:0.60:::::::*
cpe:2.3:a:clamav:clamav:0.88.2:::::::*
cpe:2.3:a:clamav:clamav:0.83:::::::*
cpe:2.3:a:clamav:clamav:0.20:::::::*
cpe:2.3:a:clamav:clamav:0.80:rc4::::::
cpe:2.3:a:clamav:clamav:0.90:rc3::::::
cpe:2.3:a:clamav:clamav:0.70:::::::*
cpe:2.3:a:clamav:clamav:0.88.4:::::::*
cpe:2.3:a:clamav:clamav:0.14:::::::*
cpe:2.3:a:clamav:clamav:0.24:::::::*
cpe:2.3:a:clamav:clamav:0.66:::::::*
cpe:2.3:a:clamav:clamav:0.51:::::::*
cpe:2.3:a:clamav:clamav:0.52:::::::*
cpe:2.3:a:clamav:clamav:0.22:::::::*
cpe:2.3:a:clamav:clamav:0.72:::::::*
cpe:2.3:a:clamav:clamav:0.95:rc1::::::
cpe:2.3:a:clamavs:clamav:0.06:::::::*
cpe:2.3:a:clamav:clamav:0.91:rc2::::::
cpe:2.3:a:clamav:clamav:0.75:::::::*
cpe:2.3:a:clamav:clamav:0.05:::::::*
cpe:2.3:a:clamav:clamav:0.91:::::::*
cpe:2.3:a:clamav:clamav:0.54:::::::*
cpe:2.3:a:clamav:clamav:0.96:rc1::::::
cpe:2.3:a:clamav:clamav:0.80:::::::*
cpe:2.3:a:clamav:clamav::rc2::::::*		0.96
cpe:2.3:a:clamav:clamav:0.87:::::::*
cpe:2.3:a:clamav:clamav:0.21:::::::*
cpe:2.3:a:clamav:clamav:0.84:rc2::::::
cpe:2.3:a:clamav:clamav:0.67-1:::::::*
cpe:2.3:a:clamav:clamav:0.14:pre::::::
cpe:2.3:a:clamav:clamav:0.90.1:::::::*
cpe:2.3:a:clamav:clamav:0.91.1:::::::*
cpe:2.3:a:clamav:clamav:0.95.3:::::::*
cpe:2.3:a:clamav:clamav:0.88.3:::::::*
cpe:2.3:a:clamav:clamav:0.67:::::::*
cpe:2.3:a:clamav:clamav:0.92.1:::::::*
cpe:2.3:a:clamav:clamav:0.90.2:::::::*
cpe:2.3:a:clamav:clamav:0.68:::::::*
cpe:2.3:a:clamav:clamav:0.53:::::::*
cpe:2.3:a:clamav:clamav:0.93.2:::::::*
cpe:2.3:a:clamav:clamav:0.88.6:::::::*
cpe:2.3:a:clamav:clamav:0.94.1:::::::*
cpe:2.3:a:clamav:clamav:0.82:::::::*
cpe:2.3:a:clamav:clamav:0.73:::::::*