CVE-2021-27506

The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://advisories.stormshield.eu/2021-003/	Broken Link Vendor Advisory
https://blog.clamav.net/2021/02/clamav-01031-patch-release.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:netasq_project:netasq::::::::
	cpe:2.3:a:stormshield:network_security::::::::

Configuration 2 (hide)

cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-19 15:15

Updated : 2022-07-01 12:02

NVD link : CVE-2021-27506

Mitre link : CVE-2021-27506

CVE.ORG link : CVE-2021-27506

JSON object : View

Products Affected

clamav

clamav

netasq_project

netasq

stormshield

network_security

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-27506", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-03-19T15:15:12.650", "references": [{"url": "https://advisories.stormshield.eu/2021-003/", "tags": ["Broken Link", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.clamav.net/2021/02/clamav-01031-patch-release.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1."}, {"lang": "es", "value": "El componente ClamAV Engine (versi\u00f3n 0.103.1 e inferior) incrustado en Storsmshield Network Security (SNS) est\u00e1 sujeto a DoS en caso de analizar archivos png malformados. Esto afecta a las versiones 9.1.0 a 9.1.11 de Netasq y a las versiones 1.0.0 a 4.2.0 de SNS. Este problema se ha solucionado en SNS versiones 3.7.19, 3.11.7 y 4.2.1."}], "lastModified": "2022-07-01T12:02:37.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netasq_project:netasq:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9706560E-DD3E-45D1-895C-5EE59C7DFB3C", "versionEndIncluding": "9.1.11", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:a:stormshield:network_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C497E1B0-4FE7-4D06-8617-332391247B4E", "versionEndIncluding": "4.2.0", "versionStartIncluding": "1.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22A4DD0B-BD39-4BC7-BB23-114AFC9C2FAD", "versionEndIncluding": "0.103.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}