Regarding the Use of ClamAV Daemon's TCP Socket

Recently, a tweet and subsequent blog post on Errata Security describe some features of the ClamAV daemon (clamd) that may be misused toward information disclosures and denial of service attacks. We wanted to take the opportunity to inform the ClamAV community about the clamd configuration that may lead to these issues along with the steps and options for using clamd securely.

clamd is an optional feature of ClamAV providing local or remote host access to ClamAV's scanning engine through the clamd protocol. Several ClamAV commands communicate with clamd using the clamd protocol: clamdscan for virus scanning, clamdtop for clamd resource monitoring, and freshclam, when used in conjunction with clamd, to notify clamd to reload the virus database. Clamav-milter and some third party programs use the clamd protocol as well. The clamd protocol is fully described in the clamd man-page.

This feature, off by default, requires manual configuration.  In order to use clamd, an installation must select a socket type in clamd configuration file, clamd.conf. The installation has two choices for the type of socket. Their configuration parameter names are LocalSocket and TCPSocket. LocalSocket, available on Unix based systems, is not vulnerable to the information disclosure or the DoS. However, all of the programs communicating with clamd must reside on the same host system with clamd. The TCPSocket option enables communication from remote hosts, but care must be taken to protect the ingress network interfaces. An additional clamd parameter, TCPAddr, may be used to designate which network interfaces will accept clamd TCP connection requests. Those interfaces need to be protected, such as though the use of firewall or other network security mechanisms. This will ensure that unwanted clamd requests will be blocked. Additional information on the clamd configuration parameters may be found in the clamd.conf man-page and in the sample clamd configuration file distributed with ClamAV.

Finally, note that the clamscan command, and other software using the libclamav API directly, do not use clamd and therefore are not affected by this configuration.

ClamAV Signatures

As many of you know, over the past several years, we’ve been retooling the entire backend of ClamAV.net’s signature management system to handle a more streamlined release method and signature generation system.  Now that this work is complete, we’re reaching out to those of you in our ClamAV community that manage some form of third party ClamAV signature distribution systems.

We would like to potentially incorporate the feeds that you are producing into the official feed coming from our mirror network at ClamAV, out to the community.  We are going to ensure proper attribution for everyone’s work within the signature name.  

We haven’t determined what this will look like, but what we would like to see is the name of the feed, not only in the signature name, but a table to be maintained on ClamAV.net ensuring the proper mapping from signature name to your website (and donation system, if you have one).

We would be responsible for the “dropping” of a False positive prone ClamAV sig from the official db, however, our intention is to notify you of the FP on your sig when it is reported to us at the same time we are notified, so that the signature can be fixed.

This process is ongoing but if you are interested in being added to the list of those already contributing or have additional questions, please contact me at bcouncil@cisco.com. 

Your comments and concerns are also welcome.  

Create your Own Anti-Virus Signatures with ClamAV

Today I came across this older blog post (almost 10 years old at this point!) about a simple method you can use to create your won Anti-Virus signatures with ClamAV.

The article has a nice walk through of how to dump an attachment out of an email, how to write a simple ndb signature to detect it, and how to deploy it.  I thought this was fairly simple and well done, so I wanted to share.

If you are interested in creating your own detection, this article is worth checking out.

http://blog.adamsweet.org/?p=250

If you want to proceed a step further and submit those signatures back to us, we'll take a look as well, and if you submit the most in a month, we'll send you some nice swag!

ClamAV Community Signature contest winner for May, 2016

We'd like to congratulate our May winner of the monthly ClamAV Community Signature contest:   Arnaud Jacques!

Congratulations and thank you for your contributions!

For more information on how you can get involved in the monthly contest and try and win your ClamAV swag, please see my post on the blog.

Once again, thank you, and congratulations to Arnaud!