CVE-2024-20506

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files. The vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:clamav:clamav::::::::
	cpe:2.3:a:clamav:clamav::::::::
	cpe:2.3:a:clamav:clamav::::::::
	cpe:2.3:a:clamav:clamav:1.4.0:::::::*

History

25 Mar 2025, 17:15

Type	Values Removed	Values Added
References	~~() https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html - Release Notes~~	() https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html - Release Notes

Information

Published : 2024-09-04 22:15

Updated : 2025-03-25 17:15

NVD link : CVE-2024-20506

Mitre link : CVE-2024-20506

CVE.ORG link : CVE-2024-20506

JSON object : View

Products Affected

clamav

clamav

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2024-20506", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.8}]}, "published": "2024-09-04T22:15:04.083", "references": [{"url": "https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html", "tags": ["Release Notes"], "source": "psirt@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-754"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 and prior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11 and all prior versions could allow an authenticated, local attacker to corrupt critical system files.\r\n\r\nThe vulnerability is due to allowing the ClamD process to write to its log file while privileged without checking if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability if they replace the ClamD log file with a symlink to a critical system file and then find a way to restart the ClamD process. An exploit could allow the attacker to corrupt a critical system file by appending ClamD log messages after restart."}, {"lang": "es", "value": "Una vulnerabilidad en el m\u00f3dulo de servicio ClamD de Clam AntiVirus (ClamAV) versiones 1.4.0, 1.3.2 y anteriores, todas las versiones 1.2.x, 1.0.6 y anteriores, todas las versiones 0.105.x, todas las versiones 0.104.x y 0.103.11 y anteriores podr\u00eda permitir que un atacante local autenticado corrompa archivos cr\u00edticos del sistema. La vulnerabilidad se debe a que permite que el proceso ClamD escriba en su archivo de registro mientras tiene privilegios sin comprobar si el archivo de registro ha sido reemplazado por un enlace simb\u00f3lico. Un atacante podr\u00eda aprovechar esta vulnerabilidad si reemplaza el archivo de registro de ClamD por un enlace simb\u00f3lico a un archivo cr\u00edtico del sistema y luego encuentra una forma de reiniciar el proceso ClamD. Una vulnerabilidad podr\u00eda permitir que el atacante corrompa un archivo cr\u00edtico del sistema a\u00f1adiendo mensajes de registro de ClamD despu\u00e9s del reinicio."}], "lastModified": "2025-03-25T17:15:47.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C21D8C4B-CEBE-422C-A103-B516EBCC34B6", "versionEndExcluding": "0.103.12"}, {"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D3AF611-42CD-4EC8-9A2A-89AEC62A3D6E", "versionEndExcluding": "1.0.7", "versionStartIncluding": "0.104.0"}, {"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD0EA13B-FFC9-4385-8691-38A90DCE774F", "versionEndExcluding": "1.3.2", "versionStartIncluding": "1.2.0"}, {"criteria": "cpe:2.3:a:clamav:clamav:1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D7F43F7-EF41-4CB7-A013-6A8F274F973D"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}