cbcvebase.
CVE-2023-20032
published 2023-03-01

CVE-2023-20032: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions…

PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
29.31%
98.0th percentile
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"].

Affected

71 ranges· showing 25
VendorProductVersion rangeFixed in
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint
ciscocisco_secure_endpoint_private_cloud_administration_portal
ciscocisco_secure_web_appliance
ciscocisco_secure_web_appliance

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered by submitting a crafted HFS+ partition file to be scanned by ClamAV; detection should focus on scanning of HFS+ partition files that result in heap buffer overflow conditions in the ClamAV process.
  • Monitor the ClamAV scanning process for unexpected crashes (DoS) or privilege escalation, particularly on Windows where ClamAV runs in a privileged security context (Cisco Secure Endpoint Connector for Windows is critically impacted).
  • The root cause is a missing buffer size check in the HFS+ partition file parser leading to a heap buffer overflow write; look for anomalous memory writes in the ClamAV process when processing HFS+ images.
  • Researcher Simon Scannell discovered this issue in ClamAV's HFS+ file parsing; threat hunting should focus on ClamAV instances processing HFS+ partition files from remote/unauthenticated sources.
  • ·Affected ClamAV versions are 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier; fixed versions include 1.0.1 and 0.103.8. Ensure ClamAV is updated beyond these thresholds.
  • ·Cisco Secure Endpoint Private Cloud itself is not impacted, but the Secure Endpoint Connector software distributed from the device is impacted; patch the connector software accordingly.
  • ·On Linux and Mac platforms, the SIR is rated Medium (not Critical) because ClamAV runs in a lower-privileged context; prioritize patching Windows-based deployments first.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_cisco9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.