CVE-2015-2170

What it actually does

Improper input validation in the UPX decoder allows a crafted file to trigger a crash in the scanning engine.

Why it matters to the business

Scanning services on affected OpenStack components become unavailable, interrupting file and malware checks for virtual machines, images, and storage operations until the service is restarted.

How an attack unfolds

An attacker crafts a malicious UPX-compressed file and submits it to any ClamAV-based scanner integrated with the affected OpenStack services; the decoder fails to handle the malformed input and crashes the process.

How to fix it

Upgrade nova, glance, and cinder packages on Debian 10/11/12/13 to the versions listed in the fixed_versions (e.g., nova 2:13.0.0-1, glance 2:12.0.0-1, cinder 2:8.0.0-1) and on Ubuntu 14.04 LTS to 1:2014.1.5-0ubuntu1.7 or later; restart affected services after upgrade.

How to confirm the fix worked

Confirm package versions match or exceed the listed fixed releases on each distribution, then run ClamAV regression tests with known UPX samples and verify the scanner no longer crashes on the crafted input.

Typical attack path

1. Identify an entry point that invokes ClamAV scanning (file upload, image import, volume attach)
2. Deliver a specially crafted UPX file
3. Trigger the UPX decoder path
4. Observe process crash and service restart loop

How to detect it

Review ClamAV and OpenStack service logs for unexpected crashes or segmentation faults around the time of file-processing operations; correlate with file-upload or image-import events.

What your security team should do

• Apply the listed package upgrades immediately on all Debian and Ubuntu deployments of nova, glance, and cinder
• Add the fixed package versions to automated patch-management policies
• Monitor ClamAV process health and restart counts until patches are deployed