CVE:CVE-2006-1614
CNNVD:CNNVD-200604-078
Clam AntiVirus是Unix的GPL杀毒工具包，很多邮件网关产品都在使用。
ClamAV中存在多个安全漏洞，可能允许恶意用户导致拒绝服务并入侵系统。
1) libclamav/pe.c的cli_scanpe()函数的PE首部解析程序存在整数溢出漏洞。攻击者可以通过特制的UPX文件导致堆溢出并执行任意代码。
成功攻击要求禁用了ArchiveMaxFileSize选项。
2) shared/output.c中的日志处理时的一些格式串错误可能允许执行任意代码。
3) ibclamav/others.c的cli_bitset_test()函数中的越界内存访问错误可能导致崩溃。
solution:Upgrade clam_anti-virus clamav to a higher version than 0.51,0.52,0.53,0.54,0.60,0.65,0.67,0.68,0.68.1,0.70,0.75.1,0.80,0.80_rc1,0.80_rc2,0.80_rc3,0.80_rc4,0.81,0.82,0.83,0.84,0.84_rc1,0.84_rc2,0.85,0.85.1,0.86,0.86.1,0.86.2,0.87,0.87.1,0.88,and avoid the version 0.51,0.52,0.53,0.54,0.60,0.65,0.67,0.68,0.68.1,0.70,0.75.1,0.80,0.80_rc1,0.80_rc2,0.80_rc3,0.80_rc4,0.81,0.82,0.83,0.84,0.84_rc1,0.84_rc2,0.85,0.85.1,0.86,0.86.1,0.86.2,0.87,0.87.1,0.88