{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20506", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.688Z", "datePublished": "2024-09-04T21:28:54.812Z", "dateUpdated": "2024-09-05T13:34:52.623Z"}, "containers": {"cna": {"title": "ClamAV Privilege Handling Escalation Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r\n\r\nThe vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart."}], "references": [{"url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"}], "source": {"discovery": "EXTERNAL", "defects": ["CSCwk31741"]}, "affected": [{"vendor": "Cisco", "product": "ClamAV", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.3.2"}, {"status": "affected", "version": "1.0.6"}, {"status": "affected", "version": "1.0.5"}, {"status": "affected", "version": "1.0.4"}, {"status": "affected", "version": "1.0.3"}, {"status": "affected", "version": "1.0.2"}, {"status": "affected", "version": "1.0.1"}, {"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.2.x"}, {"status": "affected", "version": "0.105.x"}, {"status": "affected", "version": "0.104.x"}, {"status": "affected", "version": "0.103.11"}, {"status": "affected", "version": "0.103.10"}, {"status": "affected", "version": "0.103.9"}, {"status": "affected", "version": "0.103.8"}, {"status": "affected", "version": "0.103.7"}, {"status": "affected", "version": "0.103.6"}, {"status": "affected", "version": "0.103.5"}, {"status": "affected", "version": "0.103.4"}, {"status": "affected", "version": "0.103.3"}, {"status": "affected", "version": "0.103.2"}, {"status": "affected", "version": "0.103.1"}, {"status": "affected", "version": "0.103.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-09-04T21:28:54.812Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-05T13:34:43.487532Z", "id": "CVE-2024-20506", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T13:34:52.623Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "ClamAV Privilege Handling Escalation Vulnerability", "source": {"defects": ["CSCwk31741"], "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "ClamAV", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.3.2"}, {"status": "affected", "version": "1.0.6"}, {"status": "affected", "version": "1.0.5"}, {"status": "affected", "version": "1.0.4"}, {"status": "affected", "version": "1.0.3"}, {"status": "affected", "version": "1.0.2"}, {"status": "affected", "version": "1.0.1"}, {"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.2.x"}, {"status": "affected", "version": "0.105.x"}, {"status": "affected", "version": "0.104.x"}, {"status": "affected", "version": "0.103.11"}, {"status": "affected", "version": "0.103.10"}, {"status": "affected", "version": "0.103.9"}, {"status": "affected", "version": "0.103.8"}, {"status": "affected", "version": "0.103.7"}, {"status": "affected", "version": "0.103.6"}, {"status": "affected", "version": "0.103.5"}, {"status": "affected", "version": "0.103.4"}, {"status": "affected", "version": "0.103.3"}, {"status": "affected", "version": "0.103.2"}, {"status": "affected", "version": "0.103.1"}, {"status": "affected", "version": "0.103.0"}], "defaultStatus": "unknown"}], "references": [{"url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r\n\r\nThe vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart."}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-09-04T21:28:54.812Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-05T13:34:43.487532Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-09-05T13:34:48.494Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-20506", "state": "PUBLISHED", "dateUpdated": "2024-09-04T21:28:54.812Z", "dateReserved": "2023-11-08T15:08:07.688Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-09-04T21:28:54.812Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "matchCriteriaId": "C21D8C4B-CEBE-422C-A103-B516EBCC34B6", "versionEndExcluding": "0.103.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "matchCriteriaId": "8D3AF611-42CD-4EC8-9A2A-89AEC62A3D6E", "versionEndExcluding": "1.0.7", "versionStartIncluding": "0.104.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD0EA13B-FFC9-4385-8691-38A90DCE774F", "versionEndExcluding": "1.3.2", "versionStartIncluding": "1.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:clamav:clamav:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "9D7F43F7-EF41-4CB7-A013-6A8F274F973D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r\n\r\nThe vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart."}, {"lang": "es", "value": "Una vulnerabilidad en el m\u00f3dulo de servicio ClamD de Clam AntiVirus (ClamAV) versiones 1.4.0, 1.3.2 y anteriores, todas las versiones 1.2.x, 1.0.6 y anteriores, todas las versiones 0.105.x, todas las versiones 0.104.x y 0.103.11 y anteriores podr\u00eda permitir que un atacante local autenticado corrompa archivos cr\u00edticos del sistema. La vulnerabilidad se debe a que permite que el proceso ClamD escriba en su archivo de registro mientras tiene privilegios sin comprobar si el archivo de registro ha sido reemplazado por un enlace simb\u00f3lico. Un atacante podr\u00eda aprovechar esta vulnerabilidad si reemplaza el archivo de registro de ClamD por un enlace simb\u00f3lico a un archivo cr\u00edtico del sistema y luego encuentra una forma de reiniciar el proceso ClamD. Una vulnerabilidad podr\u00eda permitir que el atacante corrompa un archivo cr\u00edtico del sistema a\u00f1adiendo mensajes de registro de ClamD despu\u00e9s del reinicio."}], "id": "CVE-2024-20506", "lastModified": "2024-09-12T17:26:37.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2024-09-04T22:15:04.083", "references": [{"source": "ykramarz@cisco.com", "tags": ["Release Notes"], "url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}