Improper Check for Unusual or Exceptional Conditions

Summary

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV) affects versions through clamav-0.103.11, clamav-0.104.0-rc2 through clamav-1.0.6, clamav-1.1.0-rc through clamav-1.3.1, and clamav-1.4.0-rc through clamav-1.4.0. This vulnerability could allow an authenticated, local attacker to corrupt critical system files. The issue arises from allowing the ClamD process to write to its log file while running with elevated privileges without verifying if the logfile has been replaced with a symbolic link. An attacker could exploit this vulnerability by replacing the ClamD log file with a symlink to a critical system file and then finding a way to restart the ClamD process. Successful exploitation could allow the attacker to corrupt a critical system file by appending ClamD log messages after the restart.