Tuesday, October 30, 2018

Welcome to the ClamAV 0.101.0 beta!

Important notes about this release:

  • Changes to the libclamav API:
    • Those who build applications around our shared library will need to change how they declare and pass scanning options to libclamav. Please take a look at the change to our example code for details. 
    • Many of the scanning option #defines have changed. These can be found in our clamav.h header.
    • The libclamav version number has changed.
  • Some of the clamd config and clamscan command line option names have changed. The original versions will still work for a time, but eventually they will be deprecated. These options in question are detailed in the NEWS document.
  • A new sub-signature type called "Byte Compare". Byte Compare sub-signatures can be used to evaluate a numeric value at a given offset from the start of another (matched) sub-signature within the same logical signature. That numerical value may be interpreted from signed ascii decimal, unsigned ascii hex, or unsigned binary data relative to a match offset. Your participation in testing this feature during our beta period will be greatly appreciated. For details, see the signature writing documentation.
  • Changes to our documentation. Documentation is now in Markdown and should be easier to navigate and easier to contribute to.
  • Support for extraction/scanning of RAR v5.x archives.

For additional details on changes in 0.101, please read the notes in our NEWS document.

Thank you in advance for participating in the ClamAV 0.101 beta! Bugs should be brought to our attention via the clamav-devel mailing list or via bugzilla.

You may download the ClamAV 0.101.0 beta at the usual location on ClamAV.net.

Wednesday, October 3, 2018

ClamAV 0.100.2 has been released! This is a patch release to address several vulnerabilities.
  • Fixes for the following ClamAV vulnerabilities:
    • CVE-2018-15378:
      • Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition on an affected device.
      • Reported by Secunia Research at Flexera.
    • Fix for a two-byte buffer over-read bug in ClamAV's PDF parsing code.
      • Reported by Alex Gaynor.
    • Fixes for the following vulnerabilities in bundled third-party libraries:
    • CVE-2018-14680:
      • An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
    • CVE-2018-14681:
      • An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one- or two-byte overwrite.
    • CVE-2018-14682:
      • An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place
  • Other changes:
    • Some users have reported freshclam signature update failures as a result of a delay between the time the new signature database content is announced and the time that the content-delivery-network has the content available for download. To mitigate these errors, this patch release includes some modifications to freshclam to make it more lenient, and to reduce the time that freshclam will ignore a mirror when it detects an issue.
    • On-Access "Extra Scanning," an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, click here.
Thank you to the following ClamAV community members for your code submissions
and bug reports:

- Alex Gaynor
- Hiroya Ito
- Laurent Delosieres, Secunia Research at Flexera

Thursday, September 13, 2018

Executive summary

ClamAV Signature Creator (CASC) is an IDA Pro plugin that assists in the creation of ClamAV pattern signatures. We have enhanced this plugin to also analyze these signatures. The plugin highlights matching parts in a binary when its given a particular signature. This function is helpful when evaluating automatically generated signatures, e.g., from the BASS framework. As a larger number of signatures is automatically generated, it becomes ever more important to gain a quick understanding about the effects of these signatures. This functionality will allow us to check the accuracy of our signatures faster, and allow us to deliver a better product to our users.


The signature analysis function integrates neatly into the existing CASC plugin. Because the signature analyzer (“SigAnalyzer”) function needs some extra libraries, the installation of the plugin changes slightly — you can install the library dependencies via your distribution if you use the system Python (e.g., on Linux on a 32-bit machine for any IDA version or on Linux with IDA 7.0 on a 64-bit machine), or you can use the provided ZIP archives with bundled library dependencies. Detailed installation instructions for both cases can be found in the project’s README.

If the library dependencies are satisfied, you’ll have a new tab “Analyze” next to the tab “Create” in the plugin’s pane. Here, you can paste a logical signature (ldb) or pattern signature (ndb), and press “Add signature.” The signature will appear in the “Signatures” list above if it parsed correctly. If nothing happens, keep an eye on error messages in IDA’s output window. Now you can double-click the signature in the list. For an ndb signature, this will directly take you to the match in the IDA-View window. The match is green-colored.

An ldb signature will show all sub-signatures on the right list instead. You can double-click on a sub-signature, and it will color the match and bring you to it. Keep an eye on the text row above the “Add signature” button — you can find more information on the match there, or a message if there is no match. Added signatures are stored inside the database, and will be available again in the signature selection window the next time you open the database.

Internally, the plugin relies on Yara-python to find matches. ClamAV signatures are translated to Yara rules, which are then matched against the binary data. The plugin’s source code is available on our GitHub page, as well as in installation packages for your convenience. Please go ahead and test the new functionality, but keep in mind that the functionality is in an early beta stage, and still may have a bug or two. If you come across a bug, or you want to comment, please don't hesitate to let us know through a GitHub issue.

We are excited to have our users use this new feature. Please continue to follow along on the blog for new ClamAV features as we develop them, and be sure to follow us on Twitter.

Wednesday, September 5, 2018

At Cisco Talos, we regularly get questions on how to get the most out of ClamAV. Therefore, we wanted to point out some common mistakes that users make in hopes that we can make using ClamAV easier, and more effective, for everyone.

Downloading the signatures

We want to emphasize the importance of using FreshClam to download the signatures instead of Wget, Python, or similar scripting libraries. A lot of folks from the community are attempting to download the daily, bytecode, and the main CVDs using scripting tools. While we understand the desire to do so, FreshClam has been engineered to take advantage of the fact that our publishing system provides "diff" files, or only what has changed since the last update.

This provides faster updates to the world, reduces our overhead on the server side, and lowers our overall bandwidth. This problem was not made apparent until we consolidated the mirror infrastructure to our CDN (Cloudflare). We are now able to observe download problems across our infrastructure.

For example, we have roughly 20 individual IPs that are attempting to download the whole main.cvd, daily.cvd, and bytecode.cvd files roughly, eight times a minute. Imagine what would happen if we were able to get users to stop doing that and use FreshClam. We are currently pushing about 54TB a day in updates to our users — you have to wonder how much that would drop if everyone was using FreshClam.

ClamAV supported versions

We took a look at the top 10 "User-Agents" that are downloading updates.
ClamAV/0.100.1 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.99.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.98.7 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamAV/0.100.0 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
ClamWin/0.99.1 (OS: win32, ARCH: i386, CPU: i386)
ClamWin/0.99.4 (OS: win32, ARCH: i386, CPU: i386)
ClamAV/0.99.3 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Wget/1.12 (linux-gnu)
ClamAV/0.96-exp (OS: linux-gnu, ARCH: i386, CPU: i686)
Since we already covered Wget and tools like that, let's move on to older versions of ClamAV.

As you can see, the top two versions are the most recent versions and essentially, the last major version back. These are Ubuntu/Debian users. We work very closely with the package maintainer for those distributions, and we can see the shift in versions when they update.

Let's shift our focus to No. 10 in the list above. ClamAV/0.96-exp, an experimental version of ClamAV back in the 0.96 days, before CVD diff'ing was released. Obviously, this is an errant cronjob (someone attempting to run FreshClam once a minute). Again, we are asking users to please update to a new version of ClamAV, which will, in turn, update your version of FreshClam (to support diff'ing).

We took the logs, removed Wget, curl and other scripting tools, only focusing on actual FreshClam installations, only focusing on versions of ClamAV.  Basically, asking our logs, "How many different versions of ClamAV are there out there?"


After ClamAV is installed, then what? How do I update the database?

You will want to edit freshclam.conf.example by commenting out the "example" text with a pound symbol (#).

Once that is done, run a 'freshclam' via command line and the database should update.

We also want to remind people that we do monitor IRC, so if you need help — give us a shout.

Community members and staff idle the channel and try to help to the best of our abilities.

IRC information

Service: irc.freenode.net
Channel: #clamav

How do you submit bugs to ClamAV?

Please visit https://bugzilla.clamav.net/.

If you are having Mirror issues

If you are running into an issue when using FreshClam to download the signatures, it could be the mirror.dat file. Try deleting this file, and then running FreshClam again.

In the "configure" file of FreshClam, you can set your mirror as 'database.clamav.net' instead of using a country code (db.xy.clamav.net).  In a future version of ClamAV, we will improve/remove the mentions of country based mirrors. Use database.clamav.net as the central point for your downloads.

If you want to contribute to documentation

Our documentation is also open-source. Feel free to edit it as need be, and submit the changes to our Git repository.

Monday, July 30, 2018

If you use ClamAV’s Git repository, you may have noticed that we’ve recently changed our Git workflow.

It’s a big departure from what we had been doing, and we believe it will be a major improvement. Our new workflow took inspiration from the popular and well-known GitFlow model, and it shares some of its features. However, to better suit our needs, we’ve made a number of modifications and simplifications to the original GitFlow paradigm. Here’s a rundown of some of the most important changes:

  1. New commits will go into dev/0.101 instead of master.  The default branch will now be dev/0.101.
    • When unit tests, system tests, and regression tests on dev/0.101 are up to snuff, we will cherry-pick the commits over to master. This way, master will always be stable. 
  2. When we’re ready to release, we will create a release branch (rel/0.101) from master and tag the release (0.101.0). 
  3. A new dev branch will be created for the next feature release (dev/0.102) and will be set as the default branch. 
  4. Any urgent security or bug-fix patches will be applied both to the new dev branch (dev/0.102) and to the previous dev branch (dev/0.101).  
    • After successful testing on dev/0.100, the patch(es) will be cherry-picked to rel/0.101 and tagged for the patch version release (0.101.1). 
    • Meanwhile, the same urgent patch(es) will undergo normal testing in the current dev branch (dev/0.102). Security related patches will remain private until the patch version release is published.
  5. The goal going forward is for master to always be stable, so we can publish releases as frequently as needed.  With this workflow and versioning scheme, it will also be easy to create patch releases. 

As a disclaimer:  We’re just getting started with the new Git workflow, which means that master isn’t proven stable yet. Also, we have some major automation improvements to make to our system and regression-testing processes that will make this workflow highly effective. The automation improvements are still in the works, and are probably a couple months out. Until then, any testing done before we cherry-pick changes to master will be mostly manual.

The takeaway from this is that these are the important branches in the ClamAV Git repository:
  • dev/0.101 — The latest unstable code in development.
  • master — The latest tested stable code.
  • rel/0.100 — The latest released version, which is also posted on clamav.net.
  • dev/0.100 — The previous development branch, used to test hotfixes prior to a patch release. 
For any further questions or discussion please head on over to our ClamAV-devel mailing list

Thank you.

Monday, July 9, 2018

ClamAV 0.100.1 is a hotfix release to patch a set of vulnerabilities.
  • Fixes for the following CVE's:
  • Fixes for a few additional bugs:
    • Buffer over-read in unRAR code due to missing max value checks in table initialization. Reported by Rui Reis.
    • Libmspack heap buffer over-read in CHM parser. Reported by Hanno Böck.
    • PDF parser bugs reported by Alex Gaynor.
      • Buffer length checks when reading integers from non-NULL terminated strings.
      • Buffer length tracking when reading strings from dictionary objects.
  • HTTPS support for clamsubmit.
  • Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only. Patch provided by Guilherme Benkenstein.
Thank you to the following ClamAV community members for your code submissions and bug reports!
  • aCaB
  • Alex Gaynor
  • Guilherme Benkenstein
  • Hanno Böck
  • Rui Reis
  • Laurent Delosieres, Secunia Research at Flexera

Monday, April 9, 2018

Join us as we welcome ClamAV 0.100.0 to the family officially.  You can grab it, as always, from the downloads page on ClamAV.net.

ClamAV 0.100.0 is a feature release which includes many code submissions from the ClamAV community.  Some of the more prominent submissions include:

  • Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
  • Support for Visual Studio 2015 for Windows builds.  Please note that we have deprecated support for Windows XP, and while Vista may still work, we no longer test ClamAV on Windows XP or Vista.
  • Support libmspack internal code or as a shared object library. The internal library is the default and includes modifications to enable parsing of CAB files that do not entirely adhere to the CAB file format.
  • Linking with OpenSSL 1.1.0.
  • Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
  • Numerous bug fixes, typo corrections, and compiler warning fixes.

Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:

  • Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: ./configure --with-system-llvm=no, but it no longer compiles on all platforms.
  • Compute and check PE import table hash (a.k.a. "imphash") signatures.
  • Support file property collection and analysis for MHTML files.
  • Raw scanning of PostScript files.
  • Fix clamsubmit to use the new virus and false positive submission web interface.
  • Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
  • Improved decoders for PDF files.
  • Reduced number of compile time warnings.
  • Improved support for C++11.
  • Improved detection of system installed libraries.
  • Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
  • Improvements to clamd's On-Access scanning capabilities for Linux.


The ClamAV team thanks the following individuals for their code submissions:

  • Andreas Schulze
  • Anthony Chan
  • Bill Parker
  • Chris Miserva
  • Daniel J. Luke
  • Georgy Salnikov
  • James Ralston
  • Jonas Zaddach
  • Keith Jones
  • Marc Deslauriers
  • Mark Allan
  • Matthew Boedicker
  • Michael Pelletier
  • Ningirsu
  • Sebastian Andrzej Siewior
  • Stephen Welker
  • Tuomo Soini

Known Issues

ClamAV has an active issue queue and enjoys continual improvement but as sad as
 I am to say it, we couldn't address every bug in this release.  I want to draw
 your attention a couple bugs in particular so as not to frustrate users
 setting up ClamAV:

  • Platform: macOS:
    • Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call.

  • Platform: CentOS 6 32bit, older versions of AIX:
    • Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib.

  • Platform: Miscellaneous
    • Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.