CVE-2021-1405
📋 TL;DR
This vulnerability in ClamAV's email parsing module allows an unauthenticated remote attacker to cause a denial of service by sending a crafted email, crashing the scanning process. It affects ClamAV version 0.103.1 and all prior versions, impacting systems using ClamAV for email scanning.
💻 Affected Systems
- Clam AntiVirus (ClamAV)
📦 What is this software?
Clamav by Clamav
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for ClamAV scanning, potentially disrupting email processing or antivirus protection on affected devices.
Likely Case
Temporary service disruption due to ClamAV process crashes, requiring manual restart or system recovery.
If Mitigated
Minimal impact if patched or workarounds applied, with only isolated crashes if exploitation occurs.
🎯 Exploit Status
Exploitation involves sending a crafted email, which is straightforward; no public proof-of-concept is known, but weaponization is likely due to the simplicity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.103.2
Vendor Advisory: https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html
Restart Required: Yes
Instructions:
1. Update ClamAV to version 0.103.2 or later using your package manager (e.g., 'apt-get update && apt-get upgrade clamav' on Debian/Ubuntu). 2. Restart the ClamAV service or system if necessary.
🔧 Temporary Workarounds
Disable email scanning
allTemporarily disable ClamAV's email parsing module to prevent exploitation.
Edit ClamAV configuration to remove or comment out email scanning options, e.g., in clamd.conf set 'ScanMail false'.
🧯 If You Can't Patch
- Implement network filtering to block suspicious emails or restrict email sources.
- Monitor ClamAV processes and set up automatic restart scripts to mitigate DoS impact.
🔍 How to Verify
Check if Vulnerable:
Check ClamAV version with 'clamscan --version' or 'clamd --version'; if version is 0.103.1 or earlier, it is vulnerable.Check Version:
clamscan --versionVerify Fix Applied:
After patching, verify version is 0.103.2 or later using the same command and test email scanning functionality.📡 Detection & Monitoring
Log Indicators:
- Log entries indicating ClamAV process crashes, segmentation faults, or errors in email parsing modules.
Network Indicators:
- Unusual email traffic patterns or spikes in email volume targeting ClamAV servers.
SIEM Query:
Example: 'source="clamav.log" AND ("crash" OR "segmentation fault" OR "NULL pointer")'🔗 References
- https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00012.html
- https://security.gentoo.org/glsa/202104-07
- https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html
- https://lists.debian.org/debian-lts-announce/2021/04/msg00012.html
- https://security.gentoo.org/glsa/202104-07
