CVE-2020-3327: 
Clam AntiVirus vulnerability analysis and mitigation

A vulnerability (CVE-2020-3327) was discovered in the ARJ archive parsing module of Clam AntiVirus (ClamAV) Software versions 0.102.2. The vulnerability was initially disclosed on May 12, 2020, and affected the way ClamAV handles ARJ archive parsing (ClamAV Blog). The initial fix released in version 0.102.3 was found to be incomplete, requiring a subsequent patch in version 0.102.4 (Ubuntu Security).

The vulnerability stems from improper bounds checking of an unsigned variable in the ARJ archive parsing module, resulting in a heap buffer overflow read condition. The issue occurs when processing specially crafted ARJ files, leading to an out-of-bounds read which can cause the application to crash (ClamAV Blog, Debian Security). The vulnerability has been assigned a CVSS 3.1 base score of 7.5 (High), with attack vector: Network, attack complexity: Low, privileges required: None, user interaction: None, scope: Unchanged, and impact primarily affecting availability (Ubuntu Security).

The primary impact of this vulnerability is the potential for a denial of service (DoS) condition. When successfully exploited, an attacker can cause the ClamAV scanning process to crash, disrupting the antivirus scanning functionality (CVE Mitre).

The vulnerability can be exploited by an unauthenticated, remote attacker by sending a crafted ARJ file to an affected device. No special privileges or user interaction are required for exploitation (Debian Security).

The vulnerability was addressed in ClamAV version 0.102.4. Users are advised to upgrade to this version or later to resolve the issue. The fix properly implements bounds checking in the ARJ archive parsing module (Gentoo Security, Ubuntu Security).