Re: ClamAV Multiple Rem0te Buffer Overflows
>But then the advisory only lists 3 formats.
>So, was this just a typo by the researchers? Or are there really 4
>bugs, and the latest release still has one bug that hasn't been fixed
>yet?
>This demonstrates one of the Four I's of security advisory problems,
>namely Inconsistency. The other three are Inaccurate, Incomplete, or
>Incomprehensible.
The advisory on rem0te.com is correct. On the same note, the release notes by
clamav are not completely wrong. They fixed the same mistake in two different
processors for the same format. So clamav is probably counting the two
instances of the same mistake as one mistake.
Specifically, one of the formats (TNEF) contained two processors with the same
mistake: tnef_message() & tnef_attachment(). Both were fixed by the clamav team
in 0.86.2.