CVE-2007-4560: clam_anti-virus clamav OS Command Injection
Vulnerability summary
CVE-2007-4560 is a high (CVSS 7.6) OS Command Injection vulnerability in clam_anti-virus clamav. EPSS estimates a 83.54% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 28-08-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
83.54%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 83.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundClamAV Milter - Blackhole-Mode Remote Code Execution (Metasploit)
Maturity: weaponized
ClamAV Milter 0.92.2 - Blackhole-Mode (Sendmail) Code Execution (Metasploit)
Maturity: weaponized
Sendmail with clamav-milter < 0.91.2 - Remote Command Execution
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Clam_anti-virus1 product
- clamav≤ 0.91.1
Debian1 product
- clamav< 0.91.2-1~volatile1
2 vendors · 2 products
References
22 links- www.redhat.com/archives/fedora-package-announce/2007-September/msg00104.htmlVendor AdvisoryX Refsource FEDORA
Show all 22 references
- docs.info.apple.com/article.html?artnum=307562X Refsource CONFIRM