ClamAV HFS+ Partition Scanning Buffer Overflow Vulnerability Affecting Cisco Products: February 2023

Impact: Critical

Description: On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed:
A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code.

This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition.

Notes:
• The Security Impact Rating (SIR) for this vulnerability is Critical only for Windows-based platforms because those platforms run the ClamAV scanning process in a privileged security context. The platforms that are critically impacted include Cisco Secure Endpoint Connector for Windows.
• The SIR for this vulnerability is Medium on other platforms, including Linux and Mac platforms, because those platforms run the ClamAV scanning process in a lower-privileged security context. The affected platforms include Cisco Secure Web Appliance and Secure Endpoint Connector for Linux and Mac.
• Cisco Secure Endpoint Private Cloud itself is not impacted by this vulnerability. However, the Secure Endpoint Connector software that is distributed from the device is impacted.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy