CVE-2020-3350

NameCVE-2020-3350
DescriptionA vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2314-1, ELA-286-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
clamav (PTS)jessie, jessie (lts)0.103.9+dfsg-0+deb8u1fixed
stretch (security)0.103.6+dfsg-0+deb9u1fixed
stretch (lts), stretch0.103.9+dfsg-0+deb9u1fixed
buster (security), buster, buster (lts)0.103.9+dfsg-0+deb10u1fixed
bullseye0.103.10+dfsg-0+deb11u1fixed
bookworm1.0.7+dfsg-1~deb12u1fixed
sid, trixie1.4.1+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
clamavsourcejessie0.102.4+dfsg-0+deb8u1ELA-286-1
clamavsourcestretch0.102.4+dfsg-0+deb9u1DLA-2314-1
clamavsourcebuster0.102.4+dfsg-0+deb10u1
clamavsource(unstable)0.102.4+dfsg-1

Notes

https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html

Search for package or bug name: Reporting problems