Monday, July 30, 2018

If you use ClamAV’s Git repository, you may have noticed that we’ve recently changed our Git workflow.


It’s a big departure from what we had been doing, and we believe it will be a major improvement. Our new workflow took inspiration from the popular and well-known GitFlow model, and it shares some of its features. However, to better suit our needs, we’ve made a number of modifications and simplifications to the original GitFlow paradigm. Here’s a rundown of some of the most important changes:

  1. New commits will go into dev/0.101 instead of master.  The default branch will now be dev/0.101.
    • When unit tests, system tests, and regression tests on dev/0.101 are up to snuff, we will cherry-pick the commits over to master. This way, master will always be stable. 
  2. When we’re ready to release, we will create a release branch (rel/0.101) from master and tag the release (0.101.0). 
  3. A new dev branch will be created for the next feature release (dev/0.102) and will be set as the default branch. 
  4. Any urgent security or bug-fix patches will be applied both to the new dev branch (dev/0.102) and to the previous dev branch (dev/0.101).  
    • After successful testing on dev/0.100, the patch(es) will be cherry-picked to rel/0.101 and tagged for the patch version release (0.101.1). 
    • Meanwhile, the same urgent patch(es) will undergo normal testing in the current dev branch (dev/0.102). Security related patches will remain private until the patch version release is published.
  5. The goal going forward is for master to always be stable, so we can publish releases as frequently as needed.  With this workflow and versioning scheme, it will also be easy to create patch releases. 

As a disclaimer:  We’re just getting started with the new Git workflow, which means that master isn’t proven stable yet. Also, we have some major automation improvements to make to our system and regression-testing processes that will make this workflow highly effective. The automation improvements are still in the works, and are probably a couple months out. Until then, any testing done before we cherry-pick changes to master will be mostly manual.


The takeaway from this is that these are the important branches in the ClamAV Git repository:
  • dev/0.101 — The latest unstable code in development.
  • master — The latest tested stable code.
  • rel/0.100 — The latest released version, which is also posted on clamav.net.
  • dev/0.100 — The previous development branch, used to test hotfixes prior to a patch release. 
For any further questions or discussion please head on over to our ClamAV-devel mailing list
http://lists.clamav.net/mailman/listinfo/clamav-devel

Thank you.

Monday, July 9, 2018

ClamAV 0.100.1 is a hotfix release to patch a set of vulnerabilities.
  • Fixes for the following CVE's:
  • Fixes for a few additional bugs:
    • Buffer over-read in unRAR code due to missing max value checks in table initialization. Reported by Rui Reis.
    • Libmspack heap buffer over-read in CHM parser. Reported by Hanno Böck.
    • PDF parser bugs reported by Alex Gaynor.
      • Buffer length checks when reading integers from non-NULL terminated strings.
      • Buffer length tracking when reading strings from dictionary objects.
  • HTTPS support for clamsubmit.
  • Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only. Patch provided by Guilherme Benkenstein.
Thank you to the following ClamAV community members for your code submissions and bug reports!
  • aCaB
  • Alex Gaynor
  • Guilherme Benkenstein
  • Hanno Böck
  • Rui Reis
  • Laurent Delosieres, Secunia Research at Flexera

Monday, April 9, 2018

Join us as we welcome ClamAV 0.100.0 to the family officially.  You can grab it, as always, from the downloads page on ClamAV.net.

ClamAV 0.100.0 is a feature release which includes many code submissions from the ClamAV community.  Some of the more prominent submissions include:


  • Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
  • Support for Visual Studio 2015 for Windows builds.  Please note that we have deprecated support for Windows XP, and while Vista may still work, we no longer test ClamAV on Windows XP or Vista.
  • Support libmspack internal code or as a shared object library. The internal library is the default and includes modifications to enable parsing of CAB files that do not entirely adhere to the CAB file format.
  • Linking with OpenSSL 1.1.0.
  • Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
  • Numerous bug fixes, typo corrections, and compiler warning fixes.


Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:


  • Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: ./configure --with-system-llvm=no, but it no longer compiles on all platforms.
  • Compute and check PE import table hash (a.k.a. "imphash") signatures.
  • Support file property collection and analysis for MHTML files.
  • Raw scanning of PostScript files.
  • Fix clamsubmit to use the new virus and false positive submission web interface.
  • Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
  • Improved decoders for PDF files.
  • Reduced number of compile time warnings.
  • Improved support for C++11.
  • Improved detection of system installed libraries.
  • Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
  • Improvements to clamd's On-Access scanning capabilities for Linux.


Acknowledgements


The ClamAV team thanks the following individuals for their code submissions:


  • Andreas Schulze
  • Anthony Chan
  • Bill Parker
  • Chris Miserva
  • Daniel J. Luke
  • Georgy Salnikov
  • James Ralston
  • Jonas Zaddach
  • Keith Jones
  • Marc Deslauriers
  • Mark Allan
  • Matthew Boedicker
  • Michael Pelletier
  • Ningirsu
  • Sebastian Andrzej Siewior
  • Stephen Welker
  • Tuomo Soini


Known Issues


ClamAV has an active issue queue and enjoys continual improvement but as sad as
 I am to say it, we couldn't address every bug in this release.  I want to draw
 your attention a couple bugs in particular so as not to frustrate users
 setting up ClamAV:


  • Platform: macOS:
    • Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call.



  • Platform: CentOS 6 32bit, older versions of AIX:
    • Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib.



  • Platform: Miscellaneous
    • Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.

Friday, April 6, 2018

Community --

Over the next several weeks, you are going to see some changes made to our ClamAV mirror infrastructure.  This shouldn't result in any outages or issues, but will improve the reliability of  downloads.

You may see mirrors fall out of rotation, and new ones inserted.  This is intentional.  If there are any questions, or issues, please address them on the ClamAV-Mirrors list.

Thank you for your patience.

Wednesday, March 28, 2018

Hey everyone,

I wanted to point everyone to a git repository, located here.
I'm pointing this out because if you navigate to the 'manual' folder, you will now see new directories and such. The most important thing you will see is "Installation from source" guides for various operating systems. 


This is where we want your assistance. I started the documents, but am asking for any community help to continuously maintain these in markdown. We want to have better documentation moving forward to help new and existing users.

I will also be updating these as newer versions come out. But, it would also be helpful from a community standpoint to have another set of eyes to make sure they are accurate, easy to read and understandable.

Once these are a little more cleaned up, we will be putting them on the website as well.
Keep in mind, these installer guides are "installing from source." Though, I am not opposed to having package maintainers also store documentation here for the ClamAV installer(s) that are created, but that will be their decision. All edits will be reviewed by myself, and then pushed to the repository.

Have a good day!

Thursday, March 22, 2018

0.100.0-rc (Release Candidate) Notes


ClamAV 0.100.0 is a feature release (candidate) which includes many code submissions from the ClamAV community.  As always, it can be downloaded from our downloads site on clamav.net. Some of the more prominent submissions include:


  •  Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
  •  Support for Visual Studio 2015 for Windows builds.
  •  Support libmspack internal code or as a shared object library. The internal library is the default and contains additional integrity checks.
  •  Linking with openssl 1.1.0.
  •  Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
  •  Numerous bug fixes, typo corrections, and compiler warning fixes.


Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:


  • Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: `./configure --with-system-llvm=no`, but it no longer compiles on all platforms.
  •  Compute and check PE import table hash (a.k.a. "imphash") signatures.
  •  Support file property collection and analysis for MHTML files.
  •  Raw scanning of PostScript files.
  •  Fix clamsubmit to use the new virus and false positive submission web interface.
  •  Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
  •  Improved decoders for PDF files.
  •  Reduced number of compile time warnings.
  •  Improved support for C++11.
  •  Improved detection of system installed libraries.
  •  Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
  •  Improvements to clamd's On-Access scanning capabilities for Linux.


Acknowledgements


The ClamAV team thanks the following individuals for their code submissions:

Andreas Schulze
Anthony Chan
Bill Parker
Chris Miserva
Daniel J. Luke
Georgy Salnikov
James Ralston
Jonas Zaddach
Keith Jones
Marc Deslauriers
Mark Allan
Matthew Boedicker
Michael Pelletier
Ningirsu
Sebastian Andrzej Siewior
Stephen Welker
Tuomo Soini

Known Issues


ClamAV has an active issue queue and enjoys continual improvement but as sad as I am to say it, we couldn't address every bug in this release.  I want to draw your attention a couple bugs in particular so as not to frustrate users setting up ClamAV:


  • Platform: macOS: 
    • Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call. 
  • Platform: CentOS 6 32bit, older versions of AIX:
    • Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib. 
  •  Platform: Miscellaneous
    • Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.
Please check out 0.100.0-rc and provide us feedback on the ClamAV Mailing lists.  As always, a big thank you to the ClamAV Community!

Tuesday, March 13, 2018

Community -

I wanted to inform everyone of the functionality of ClamAV Clamsubmit

Clamsubmit is a tool that allows you to submit false positives or false negative reporting(s) in ClamAV.

in order to install and use clamsubmit, you will need to install libcurl development packages.
(for example apt-get install libcurl4-openssl-dev)

Clamsubmit:
-e [email]  email address ( required )
-h  shows help text
-N [name] your name ( required )
-n [file] submit false negative(FN)
-p [file] submit false positive(FP)

Example:
clamsubmit -e tmccourt@cisco.com -N Tom McCourt -p /opt/file

You can still use the below submit from the website. The link is below:

https://www.clamav.net/reports/malware

Clamsubmit, at this time, is only available on the *nix systems.  Sorry Windows users!  (We'd love to accept any pull requests to add this functionality!)

If you do use clamsubmit and run into any issues, please enter a ticket.
https://bugzilla.clamav.net/

If ClamAV is not detecting libcurl, when you see the summary output of the ClamAV ./configure,
it will appear like:
configure: Summary of optional tools
              clamsubmit  : no (Please use the web interface for submitting FPs/FNs.)