CVE-2024-20506
Publication date 4 September 2024
Last updated 17 September 2024
Ubuntu priority
Cvss 3 Severity Score
A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.
Status
Package | Ubuntu Release | Status |
---|---|---|
clamav | 24.04 LTS noble |
Fixed 1.0.7+dfsg-0ubuntu0.24.04.1
|
22.04 LTS jammy |
Fixed 0.103.12+dfsg-0ubuntu0.22.04.1
|
|
20.04 LTS focal |
Fixed 0.103.12+dfsg-0ubuntu0.20.04.1
|
|
18.04 LTS bionic |
Fixed 0.103.12+dfsg-0ubuntu0.18.04.1+esm1
|
|
16.04 LTS xenial |
Fixed 0.103.12+dfsg-0ubuntu0.16.04.1+esm1
|
|
14.04 LTS trusty |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProSeverity score breakdown
Parameter | Value |
---|---|
Base score | 6.1 · Medium |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | Low |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-7011-1
- ClamAV vulnerabilities
- 16 September 2024
- USN-7011-2
- ClamAV vulnerabilities
- 17 September 2024