CVE-2020-26893

An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client verification in the helper tool.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/matt-clamxav/d341bd48f12a14d2147f8ce860bb36d0	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:clamxav:clamxav:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-10-16 13:15

Updated : 2020-10-21 13:59

NVD link : CVE-2020-26893

Mitre link : CVE-2020-26893

CVE.ORG link : CVE-2020-26893

JSON object : View

Products Affected

clamxav

clamxav

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2020-26893", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-10-16T13:15:11.707", "references": [{"url": "https://gist.github.com/matt-clamxav/d341bd48f12a14d2147f8ce860bb36d0", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in ClamXAV 3 before 3.1.1. A malicious actor could use a properly signed copy of ClamXAV 2 (running with an injected malicious dylib) to communicate with ClamXAV 3's helper tool and perform privileged operations. This occurs because of inadequate client verification in the helper tool."}, {"lang": "es", "value": "Se detect\u00f3 un problema en ClamXAV 3 versiones anteriores a 3.1.1. Un actor malicioso podr\u00eda usar una copia firmada apropiadamente de ClamXAV 2 (ejecut\u00e1ndose con un dylib malicioso inyectado) para comunicarse con la herramienta auxiliar de ClamXAV 3 y llevar a cabo operaciones privilegiadas. Esto ocurre debido a una verificaci\u00f3n inadecuada del cliente en la herramienta auxiliar"}], "lastModified": "2020-10-21T13:59:20.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clamxav:clamxav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26DED1E5-037F-4C7C-B3AB-1A39A8A13731", "versionEndExcluding": "3.1.1", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}