« Volver al listado

CVE-2007-3024

Estado: ModificadaBaja (2.1)—

libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Clam Anti-virus — Clamav

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3024",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-06-07T22:30:00.000",
  "references": [
    {
      "url": "http://kolab.org/security/kolab-vendor-notice-15.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lurker.clamav.net/message/20070530.224918.5c64abc4.en.html",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25523",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25525",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25688",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/25796",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200706-05.xml",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1320",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2007_33_clamav.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/24358",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wwws.clamav.net/bugzilla/show_bug.cgi?id=517",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://kolab.org/security/kolab-vendor-notice-15.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lurker.clamav.net/message/20070530.224918.5c64abc4.en.html",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25523",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25525",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25688",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/25796",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200706-05.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1320",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2007_33_clamav.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/24358",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wwws.clamav.net/bugzilla/show_bug.cgi?id=517",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli_gentempstream function in clamd/clamdscan, which might allow local users to read sensitive files."
    },
    {
      "lang": "es",
      "value": "El libclamav/others.c del ClamAV en versiones anteriores a la 0.90.3 y la 0.91 en versiones anteriores a la 0.91rc1 usa permisos inseguros para los ficheros temporales que son creados por la función cli_gentempstream en el  clamd/clamdscan, lo cual permitiría a usuarios locales leer ficheros con información sensible."
    }
  ],
  "lastModified": "2026-06-16T22:40:53.983",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:clam_anti-virus:clamav:0.90:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "142588F8-15C3-4288-BE7C-B2F7447BD60F"
            },
            {
              "criteria": "cpe:2.3:a:clam_anti-virus:clamav:0.90.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC18418B-7477-436C-A24A-081701968DEF"
            },
            {
              "criteria": "cpe:2.3:a:clam_anti-virus:clamav:0.90.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A85C689-95E0-41F7-83D9-5A8B0AB42390"
            },
            {
              "criteria": "cpe:2.3:a:clam_anti-virus:clamav:0.90_rc1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B116E9A-0646-4AD5-A531-C35124AB02DC"
            },
            {
              "criteria": "cpe:2.3:a:clam_anti-virus:clamav:0.90_rc2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F3C25BA-72EF-4588-A90A-B323A3407FAD"
            },
            {
              "criteria": "cpe:2.3:a:clam_anti-virus:clamav:0.90_rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01FDAEBC-0B2E-4F60-8B59-13A93B1AF206"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}