ByteOS Network

NVD Vulnerability Details :

CVE-2019-1785

Analyzed

Source-ykramarz@cisco.com

Published At-08 Apr, 2019 | 19:29

Updated At-01 Mar, 2023 | 18:35

A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

ClamAV

>>clamav>>0.101.0

cpe:2.3:a:clamav:clamav:0.101.0:*:*:*:*:*:*:*

ClamAV

>>clamav>>0.101.1

cpe:2.3:a:clamav:clamav:0.101.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	nvd@nist.gov
CWE-20	Secondary	ykramarz@cisco.com

References

Hyperlink	Source	Resource
https://bugzilla.clamav.net/show_bug.cgi?id=12284	ykramarz@cisco.com	Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/201904-12	ykramarz@cisco.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History