Damian Menscher has reported a vulnerability in clamav-milter, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a design error in ClamAV's Sendmail milter that requires it to wait for all existing connections to terminate and at the same time reject new connections, when it needs to perform a database update. This can be exploited to cause a DoS on clamav-milter by opening a persistent connection to Sendmail when the milter needs to perform an update.

Successful exploitation may cause Sendmail to stop accepting incoming messages, but requires Sendmail to be configured to scan all messages using clamav-milter.

Solution
Update to version 0.86 or later.

Provided and/or discovered by
Damian Menscher

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area