Libclamav missing headers issue; Upcoming ClamAV 0.101.1 patch

Earlier this month we wrote to the ClamAV users and developers mailing lists to disclose an issue with ClamAV 0.101.0. To reach a larger audience, we are re-posting those details here.

Shortly after the 0.101.0 release was published, we discovered an issue in ClamAV 0.101.0 impacting software developers and software package maintainers that integrate libclamav into other products on Unix/Linux systems. This issue causes an error when a user attempts to compile against a system-installed libclamav. 

We have a fix staged and nearly ready to be published. The fix will be published shortly after the start of 2019 in the ClamAV 0.101.1 patch release. This delay is necessary in order to fully test the fix and complete the due diligence required when creating a new build, accounting for delays that the holiday season brings. We apologize for the inconvenience.

Here are some additional details about this patch:

• ClamAV uses a lot of mixed integer variable types internally. The preferred types are standard int types (eg int8_t, uint64_t, size_t, ptrdiff_t, etc).
• As an ongoing effort to make variable types more consistent throughout the code base, we made the mistake of including the `cltypes.h` header file in `clamav.h`, which is not only used internally, but defines the public libclamav API. Because neither the `cltypes.h` header, nor the supporting `clamav-config.h` header are provided when installing libclamav to a system, applications built with a system-installed libclamav from version 0.101.0 will fail to compile.
• To resolve the issue, we will be replacing `cltypes.h` with a new `clamav-types.h` file that is generated when the user runs `./configure.` This will be installed alongside `clamav.h` when the user runs `make install.` This will ensure that `clamav.h` has access to the necessary integer types on all operating systems and architectures.
• To mitigate similar issues in the future, we have added a test to our build-acceptance suite to test building an application against a system-installed libclamav library.

ClamAV 0.101.0 has been released!

We are pleased to announce the release of ClamAV 0.101.0!  Please take a look at the below release notes for further information.

0.101.0 Release Notes

ClamAV 0.101.0 is a feature release with an assortment of improvements that we've cooked up over the past 6 months.

Highlighted Changes:

• Our user manual has been converted from latex/pdf/html into Markdown! Markdown is easier to read & edit than latex, and is easier to contribute to as it eliminates the need to generate documents (the PDF, HTML).  The user manual is now shipped in:docs/UserManual[.md].  However, the most up to date version at any time will be on ClamAV.net (This is not live right now, but will be shortly)
• Support for RAR v5 archive extraction! We replaced the legacy C-based unrar implementation with RarLabs UnRAR 5.6.5 library. Licensing is the same as before, although our libclamunrar_iface supporting library has changed from LGPL to the BSD 3-Clause license.
• Libclamav API changes:
• The following scanning functions now require a filename argument.
• This will enable ClamAV to report more details warning and error information in the future, and will also allow for more sensible temp file names. The filename argument may be NULL if a filename is not available.
• cl_scandesc
• cl_scandesc_callback
• cl_scanmap_callback
• Scanning options have been converted from a single flag bit-field into a structure of multiple categorized flag bit-fields. This change enabled us to add new scanning options requested by the community. In addition, the name of each scan option has changed a little. As a result, the API changes will require libclamav users to modify how they initialize and pass scan options into calls such as cl_scandesc() .
• For details:
• example code
• documentation
• With our move to openssl versions >1.0.1, the cl_cleanup_crypto() function has been deprecated. This is because cleanup of open-ssl init functions is now handled by an auto-deinit procedure within the openssl library, meaning the call to EVP_cleanup() may cause problems to processes external to Clam.
• CL_SCAN_HEURISTIC_ENCRYPTED scan option was replaced by 2 new scan options:
• CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE
• CL_SCAN_HEURISTIC_ENCRYPTED_DOC
• clamd.conf and command line interface (CLI) changes:
• As in 0.100.2, the clamd.conf OnAccessExtraScanning has been temporarily disabled in order to prevent resource cleanup issues from impacting clamd stability. As noted below, OnAccessExtraScanning is an opt-in minor feature of on-access scanning on Linux systems and its loss does not significantly impact the effectiveness of on-access scanning.  The option still exists, but the feature will not be enabled and a warning will show if LogVerbose is enabled.
• For details, see: https://bugzilla.clamav.net/show_bug.cgi?id=12048
• "Heuristic Alerts" (aka "Algorithmic Detection") options have been changed to make the names more consistent. The original options are deprecated in 0.101, and will be removed in a future feature release.
• In addition, two new scan options were added to alert specifically on encrypted archives or encrypted docs. Previous functionality did both, even though it claimed to be specific to archives:
• Scan option details:

    | Old `clamd.conf` option          | *New* `clamd.conf` option    |

    | -------------------------------- | ---------------------------- |

    | `AlgorithmicDetection`           | `HeuristicAlerts`            |

    | `DetectBrokenExecutables`        | `AlertBrokenExecutables`     |

    | `PhishingAlwaysBlockCloak`       | `AlertPhishingCloak`         |

    | `PhishingAlwaysBlockSSLMismatch` | `AlertPhishingSSLMismatch`   |

    | `PartitionIntersection`          | `AlertPartitionIntersection` |

    | `BlockMax`                       | `AlertExceedsMax`            |

    | `OLE2BlockMacros`                | `AlertOLE2Macros`            |

    | `ArchiveBlockEncrypted`          | `AlertEncrypted`             |

    |                                  | `AlertEncryptedArchive`      |

    |                                  | `AlertEncryptedDoc`          |



    | Old `clamscan` option        | *New* `clamscan` option          |

    | ---------------------------- | -------------------------------- |

    | `--algorithmic-detection`    | `--heuristic-alerts`             |

    | `--detect-broken`            | `--alert-broken`                 |

    | `--phishing-cloak`           | `--alert-phishing-cloak`         |

    | `--phishing-ssl`             | `--alert-phishing-ssl`           |

    | `--partition-intersection`   | `--alert-partition-intersection` |

    | `--block-max`                | `--alert-exceeds-max`            |

    | `--block-macros`             | `--alert-macros`                 |

    | `--block-encrypted`          | `--alert-encrypted`              |

    |                              | `--alert-encrypted-archive`      |

    |                              | `--alert-encrypted-doc`          |

Some more subtle improvements:

• Logical signatures have been extended with a new sub-signature type which allows for numerical byte sequence comparison. For those familiar with Snort, this byte comparison feature works similarly to the byte_extract and byte_test feature, in that it allows signature writers to extract and compare a specified number of bytes (offset from a match) against another numeric value. You can read more about this feature, see how it works, and look over examples in our documentation.
• Backwards compatibility improvements for detecting the OpenSSL dependency.
• Freshclam updated to match exit codes defined in the freshclam.1 man page.
• Upgrade from libmspack 0.5alpha to libmspack 0.7.1alpha. As a reminder, we support system-installed versions of libmspack. However, at this time the ClamAV-provided version of libmspack provides additional abilities to parse broken or non-standard CAB files beyond what the stock libmspack 0.7.1alpha provides. We are working with the upstream project to incorporate our modifications, and hopefully these changes will appear in a future release of libmspack.
• Updated the bundled 3rd party library libxml2 included for Windows builds to version 2.9.8.
• Updated the bundled 3rd party library pcre included for Windows builds to pcre2 version 10.31.
• Upgraded Aspack PE unpacking capability with support up to version 2.42.
• Improvements to PDF parsing capability.
• Replaced the Windows installer with a new installer built using InnoSetup 5.
• Improved curl-config detection logic
• GitHub pull-request by Thomas Petazzoni.
• Added file type CL_TYPE_LNK to more easily identify Windows Shortcut files when writing signatures.
• Improved parsing of Windows executable (PE) Authenticode signatures. 
• Pull request by Andrew Williams.
• Added support for Authenticode signature properties commonly used by Windows system files. These files are now much more likely to be whitelisted correctly.
• Signature parsing now works correctly on big endian systems.
• Some simplification to freshclam mirror management code, including changes to reduce timeout on ignoring mirrors after errors, and to make freshclam more tolerant when there is a delay between the time the new signature database content is announced and the time that the content-delivery-network has the content available for download.
• Email MIME Header parsing changes to accept argument values with unbalanced quotes. Improvement should improve detection of attachments on malformed emails.
• GitHub pull request by monnerat.
• Included the config filename when reporting errors parsing ClamAV configs.
• GitHub pull request by Josh Soref.
• Improvement to build scripts for clamav-milter.
• GitHub pull request by Renato Botelho.

Other changes:

• Removed option handler for AllowSupplementaryGroups from libfreshclam. This option was previously deprecated from freshclam in ClamAV 0.100.0 but remained in libfreshclam by mistake.
• In older versions of pcre2 and in pcre, a higher PCRERecMatchLimit may cause

  clamd

  to crash on select files. We have lowered the default PCRERecMatchLimit to 2000 to reduce the likelihood of a crash and have added warnings to recommend using pcre2 v10.30 or higher to eliminate the issue.

Supporting infrastructure:

As you might imagine, ClamAV is much more than just the tarball or EXE you download and install. Here at Cisco Talos, we've been working hard on the support infrastructure that's so easy to take for granted.

• Test Frameworks
• Feature Testing:
• Throughout the development of ClamAV 0.101, our quality assurance engineers have been hard at work rebuilding our QA automation framework in Python from the ground up to test ClamAV features on 32-and-64bit versions:
• Linux: Ubuntu, Debian, CentOS, Fedora
• FreeBSD 11
• Windows 10
• In addition to building out the framework, they've written over 260 individual feature tests to validate correctness of the new features going into 0.101 as well as to validate many existing features.

•  Build Acceptance Testing:
• Another major task accomplished during the development of 0.101 was the creation of a build acceptance test framework that we run from our Jenkins CI server.

• Similar to the feature testing framework, our build acceptance framework tests across 64bit and 32bit (where available):
• macOS 10 (.10, .11, .13)
• Windows (7, 10)
• Debian (8, 9), Ubuntu (16.04, 18.04), CentOS (6, 7)
• FreeBSD (10, 11)

This pipeline creates our release materials including the Windows installers, and then validates that the basic install, update, start, scan, and stop procedures all work as expected each time commits are made to our development branches.

• Signature Database Distribution:
• During the course of ClamAV 0.101 development, our Community team has been able to migrate us from a network of third-party mirrors over to use the services of CloudFlare to provide a more unified content-delivery-network.
• With CloudFlare, users in geographic regions that had few mirrors will notice much improved signature update speeds and reliability. In addition, we're excited to be able to finally see user metrics that will help us continue to improve ClamAV. We've observed a 57% improvement in download speeds (on average) across the globe. We are of course grateful to all of the community members who have donated their server bandwidth to mirror the ClamAV signature databases over the years. Thank you so much!  We have not called for an official shutdown of the old mirror network yet.

• Development Processes:
• As many of you know, ClamAV 0.100 was in development for a good two years. Not only was this frustrating for users awaiting new features and bug-fixes, it also made for a difficult transition for users that weren't expecting two years worth of change when 0.100 landed.
• We have learned from the experience and are committed to providing shorter and more responsive ClamAV development cycles.

ClamAV 0.101 is the first of many smaller feature releases where we created a roadmap with distinct deadlines and with specific planned features. We based the feature list on both community requests and our own needs and then executed that plan.

We're very proud of ClamAV 0.101 and we hope you enjoy it.

Acknowledgements:

The ClamAV team thanks the following individuals for their code submissions:

• Andrew Williams, Cisco Talos
• Craig Andrews
• Josh Soref
• monnerat
• Renato Botelho
• tchernomax
• Thomas Petazzoni

As always, we welcome discussion about ClamAV on our mailing lists.

The ClamAV 0.101.0 release candidate is here!

The ClamAV 0.101.0 release candidate is here!

We have also made significant improvements to our User Manual (the user manual will be moved to clamav.net soon) and to the inline Doxygen documentation in clamav.h for libclamav users. Please take a peek, and consider submitting your own recommendations via GitHub pull-request. In particular, we'd love to expand the Usage section with details on how to integrate ClamAV with other software. Your input would be greatly appreciated.

A short summary of the improvements found in 0.101:

• Changes to the libclamav API:
• Those who build applications around our shared library will need to change how they declare and pass scanning options to libclamav. Please take a look at the change to our example code for details. 
• Scanning functions now have a filename argument. The argument is optional, but improves the efficiency when parsing certain types that require a file on disk to open and read, and will allow for additional improvements in the future.
• Many of the scanning option #defines have changed. These can be found in our clamav.h header.
• The libclamav version number has changed.
• Some of the clamd config and clamscan command line option names have changed. The original versions will still work for a time, but eventually they will be deprecated. These options in question are detailed in the NEWS document.
• A new sub-signature type called "Byte Compare". Byte Compare sub-signatures can be used to evaluate a numeric value at a given offset from the start of another (matched) sub-signature within the same logical signature. That numerical value may be interpreted from signed ascii decimal, unsigned ascii hex, or unsigned binary data relative to a match offset. For details, see the signature writing documentation.
• Changes to our documentation. Documentation is now in Markdown and should be easier to navigate and easier to contribute to.
• Support for extraction/scanning of RAR v5.x archives.

For additional details on changes in 0.101, please read the notes in our NEWS document.

Thank you in advance for test-driving the ClamAV 0.101 release candidate! Bugs should be brought to our attention via the clamav-devel mailing list or via bugzilla.

ClamAV 0.101.0 beta has been posted!

Welcome to the ClamAV 0.101.0 beta!

Important notes about this release:

• Changes to the libclamav API:
• Those who build applications around our shared library will need to change how they declare and pass scanning options to libclamav. Please take a look at the change to our example code for details. 
• Many of the scanning option #defines have changed. These can be found in our clamav.h header.
• The libclamav version number has changed.
• Some of the clamd config and clamscan command line option names have changed. The original versions will still work for a time, but eventually they will be deprecated. These options in question are detailed in the NEWS document.
• A new sub-signature type called "Byte Compare". Byte Compare sub-signatures can be used to evaluate a numeric value at a given offset from the start of another (matched) sub-signature within the same logical signature. That numerical value may be interpreted from signed ascii decimal, unsigned ascii hex, or unsigned binary data relative to a match offset. Your participation in testing this feature during our beta period will be greatly appreciated. For details, see the signature writing documentation.
• Changes to our documentation. Documentation is now in Markdown and should be easier to navigate and easier to contribute to.
• Support for extraction/scanning of RAR v5.x archives.

For additional details on changes in 0.101, please read the notes in our NEWS document.

Thank you in advance for participating in the ClamAV 0.101 beta! Bugs should be brought to our attention via the clamav-devel mailing list or via bugzilla.

You may download the ClamAV 0.101.0 beta at the usual location on ClamAV.net.

ClamAV 0.100.2 has been released!

ClamAV 0.100.2 has been released! This is a patch release to address several vulnerabilities.

• Fixes for the following ClamAV vulnerabilities:
• CVE-2018-15378:
• Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition on an affected device.
• Reported by Secunia Research at Flexera.
• Fix for a two-byte buffer over-read bug in ClamAV's PDF parsing code.
• Reported by Alex Gaynor.
• Fixes for the following vulnerabilities in bundled third-party libraries:
• CVE-2018-14680:
• An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.
• CVE-2018-14681:
• An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one- or two-byte overwrite.
• CVE-2018-14682:
• An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place

• Other changes:
• Some users have reported freshclam signature update failures as a result of a delay between the time the new signature database content is announced and the time that the content-delivery-network has the content available for download. To mitigate these errors, this patch release includes some modifications to freshclam to make it more lenient, and to reduce the time that freshclam will ignore a mirror when it detects an issue.
• On-Access "Extra Scanning," an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, click here.

Thank you to the following ClamAV community members for your code submissions
and bug reports:

- Alex Gaynor
- Hiroya Ito
- Laurent Delosieres, Secunia Research at Flexera

SigAnalyzer: Signature analysis with CASC

Executive summary

ClamAV Signature Creator (CASC) is an IDA Pro plugin that assists in the creation of ClamAV pattern signatures. We have enhanced this plugin to also analyze these signatures. The plugin highlights matching parts in a binary when its given a particular signature. This function is helpful when evaluating automatically generated signatures, e.g., from the BASS framework. As a larger number of signatures is automatically generated, it becomes ever more important to gain a quick understanding about the effects of these signatures. This functionality will allow us to check the accuracy of our signatures faster, and allow us to deliver a better product to our users.

Description

The signature analysis function integrates neatly into the existing CASC plugin. Because the signature analyzer (“SigAnalyzer”) function needs some extra libraries, the installation of the plugin changes slightly — you can install the library dependencies via your distribution if you use the system Python (e.g., on Linux on a 32-bit machine for any IDA version or on Linux with IDA 7.0 on a 64-bit machine), or you can use the provided ZIP archives with bundled library dependencies. Detailed installation instructions for both cases can be found in the project’s README.

If the library dependencies are satisfied, you’ll have a new tab “Analyze” next to the tab “Create” in the plugin’s pane. Here, you can paste a logical signature (ldb) or pattern signature (ndb), and press “Add signature.” The signature will appear in the “Signatures” list above if it parsed correctly. If nothing happens, keep an eye on error messages in IDA’s output window. Now you can double-click the signature in the list. For an ndb signature, this will directly take you to the match in the IDA-View window. The match is green-colored.

An ldb signature will show all sub-signatures on the right list instead. You can double-click on a sub-signature, and it will color the match and bring you to it. Keep an eye on the text row above the “Add signature” button — you can find more information on the match there, or a message if there is no match. Added signatures are stored inside the database, and will be available again in the signature selection window the next time you open the database.

Internally, the plugin relies on Yara-python to find matches. ClamAV signatures are translated to Yara rules, which are then matched against the binary data. The plugin’s source code is available on our GitHub page, as well as in installation packages for your convenience. Please go ahead and test the new functionality, but keep in mind that the functionality is in an early beta stage, and still may have a bug or two. If you come across a bug, or you want to comment, please don't hesitate to let us know through a GitHub issue.

We are excited to have our users use this new feature. Please continue to follow along on the blog for new ClamAV features as we develop them, and be sure to follow us on Twitter.

Want to improve your ClamAV experience? Here are some common mistakes we see with FreshClam

At Cisco Talos, we regularly get questions on how to get the most out of ClamAV. Therefore, we wanted to point out some common mistakes that users make in hopes that we can make using ClamAV easier, and more effective, for everyone.

Downloading the signatures

We want to emphasize the importance of using FreshClam to download the signatures instead of Wget, Python, or similar scripting libraries. A lot of folks from the community are attempting to download the daily, bytecode, and the main CVDs using scripting tools. While we understand the desire to do so, FreshClam has been engineered to take advantage of the fact that our publishing system provides "diff" files, or only what has changed since the last update.

This provides faster updates to the world, reduces our overhead on the server side, and lowers our overall bandwidth. This problem was not made apparent until we consolidated the mirror infrastructure to our CDN (Cloudflare). We are now able to observe download problems across our infrastructure.

For example, we have roughly 20 individual IPs that are attempting to download the whole main.cvd, daily.cvd, and bytecode.cvd files roughly, eight times a minute. Imagine what would happen if we were able to get users to stop doing that and use FreshClam. We are currently pushing about 54TB a day in updates to our users — you have to wonder how much that would drop if everyone was using FreshClam.

ClamAV supported versions

We took a look at the top 10 "User-Agents" that are downloading updates.

ClamAV/0.100.1 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)

ClamAV/0.99.4 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)

ClamAV/0.99.2 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)

ClamAV/0.98.7 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)

ClamAV/0.100.0 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)

ClamWin/0.99.1 (OS: win32, ARCH: i386, CPU: i386)

ClamWin/0.99.4 (OS: win32, ARCH: i386, CPU: i386)

ClamAV/0.99.3 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)

Wget/1.12 (linux-gnu)

ClamAV/0.96-exp (OS: linux-gnu, ARCH: i386, CPU: i686)

Since we already covered Wget and tools like that, let's move on to older versions of ClamAV.

As you can see, the top two versions are the most recent versions and essentially, the last major version back. These are Ubuntu/Debian users. We work very closely with the package maintainer for those distributions, and we can see the shift in versions when they update.

Let's shift our focus to No. 10 in the list above. ClamAV/0.96-exp, an experimental version of ClamAV back in the 0.96 days, before CVD diff'ing was released. Obviously, this is an errant cronjob (someone attempting to run FreshClam once a minute). Again, we are asking users to please update to a new version of ClamAV, which will, in turn, update your version of FreshClam (to support diff'ing).

We took the logs, removed Wget, curl and other scripting tools, only focusing on actual FreshClam installations, only focusing on versions of ClamAV.  Basically, asking our logs, "How many different versions of ClamAV are there out there?"

297

After ClamAV is installed, then what? How do I update the database?

You will want to edit freshclam.conf.example by commenting out the "example" text with a pound symbol (#).

Once that is done, run a 'freshclam' via command line and the database should update.

We also want to remind people that we do monitor IRC, so if you need help — give us a shout.

Community members and staff idle the channel and try to help to the best of our abilities.

IRC information

Service: irc.freenode.net
Channel: #clamav

How do you submit bugs to ClamAV?

Please visit https://bugzilla.clamav.net/.

If you are having Mirror issues

If you are running into an issue when using FreshClam to download the signatures, it could be the mirror.dat file. Try deleting this file, and then running FreshClam again.

In the "configure" file of FreshClam, you can set your mirror as 'database.clamav.net' instead of using a country code (db.xy.clamav.net).  In a future version of ClamAV, we will improve/remove the mentions of country based mirrors. Use database.clamav.net as the central point for your downloads.

If you want to contribute to documentation

Our documentation is also open-source. Feel free to edit it as need be, and submit the changes to our Git repository.

ClamAV Git Work-flow Changes

If you use ClamAV’s Git repository, you may have noticed that we’ve recently changed our Git workflow.

It’s a big departure from what we had been doing, and we believe it will be a major improvement. Our new workflow took inspiration from the popular and well-known GitFlow model, and it shares some of its features. However, to better suit our needs, we’ve made a number of modifications and simplifications to the original GitFlow paradigm. Here’s a rundown of some of the most important changes:

1. New commits will go into dev/0.101 instead of master.  The default branch will now be dev/0.101.
• When unit tests, system tests, and regression tests on dev/0.101 are up to snuff, we will cherry-pick the commits over to master. This way, master will always be stable. 
2. When we’re ready to release, we will create a release branch (rel/0.101) from master and tag the release (0.101.0). 
3. A new dev branch will be created for the next feature release (dev/0.102) and will be set as the default branch. 
4. Any urgent security or bug-fix patches will be applied both to the new dev branch (dev/0.102) and to the previous dev branch (dev/0.101).  
• After successful testing on dev/0.100, the patch(es) will be cherry-picked to rel/0.101 and tagged for the patch version release (0.101.1). 
• Meanwhile, the same urgent patch(es) will undergo normal testing in the current dev branch (dev/0.102). Security related patches will remain private until the patch version release is published.
5. The goal going forward is for master to always be stable, so we can publish releases as frequently as needed.  With this workflow and versioning scheme, it will also be easy to create patch releases. 

As a disclaimer:  We’re just getting started with the new Git workflow, which means that master isn’t proven stable yet. Also, we have some major automation improvements to make to our system and regression-testing processes that will make this workflow highly effective. The automation improvements are still in the works, and are probably a couple months out. Until then, any testing done before we cherry-pick changes to master will be mostly manual.

The takeaway from this is that these are the important branches in the ClamAV Git repository:

• dev/0.101 — The latest unstable code in development.
• master — The latest tested stable code.
• rel/0.100 — The latest released version, which is also posted on clamav.net.
• dev/0.100 — The previous development branch, used to test hotfixes prior to a patch release. 

For any further questions or discussion please head on over to our ClamAV-devel mailing list
http://lists.clamav.net/mailman/listinfo/clamav-devel

Thank you.

ClamAV 0.100.1 has been released!

ClamAV 0.100.1 is a hotfix release to patch a set of vulnerabilities.

• Fixes for the following CVE's:
  • CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).  (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932)
  • CVE-2018-0360: HWP integer overflow, infinite loop vulnerability. Reported by Secunia Research at Flexera. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0360)
  • CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Reported by aCaB. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0361)
• Fixes for a few additional bugs:
  • Buffer over-read in unRAR code due to missing max value checks in table initialization. Reported by Rui Reis.
  • Libmspack heap buffer over-read in CHM parser. Reported by Hanno Böck.
  • PDF parser bugs reported by Alex Gaynor.
    • Buffer length checks when reading integers from non-NULL terminated strings.
    • Buffer length tracking when reading strings from dictionary objects.
• HTTPS support for clamsubmit.
• Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only. Patch provided by Guilherme Benkenstein.

Thank you to the following ClamAV community members for your code submissions and bug reports!

• aCaB
• Alex Gaynor
• Guilherme Benkenstein
• Hanno Böck
• Rui Reis
• Laurent Delosieres, Secunia Research at Flexera

ClamAV 0.100.0 has been released!

Join us as we welcome ClamAV 0.100.0 to the family officially.  You can grab it, as always, from the downloads page on ClamAV.net.

ClamAV 0.100.0 is a feature release which includes many code submissions from the ClamAV community.  Some of the more prominent submissions include:

• Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
• Support for Visual Studio 2015 for Windows builds.  Please note that we have deprecated support for Windows XP, and while Vista may still work, we no longer test ClamAV on Windows XP or Vista.
• Support libmspack internal code or as a shared object library. The internal library is the default and includes modifications to enable parsing of CAB files that do not entirely adhere to the CAB file format.
• Linking with OpenSSL 1.1.0.
• Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
• Numerous bug fixes, typo corrections, and compiler warning fixes.

Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:

• Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: ./configure --with-system-llvm=no, but it no longer compiles on all platforms.
• Compute and check PE import table hash (a.k.a. "imphash") signatures.
• Support file property collection and analysis for MHTML files.
• Raw scanning of PostScript files.
• Fix clamsubmit to use the new virus and false positive submission web interface.
• Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
• Improved decoders for PDF files.
• Reduced number of compile time warnings.
• Improved support for C++11.
• Improved detection of system installed libraries.
• Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
• Improvements to clamd's On-Access scanning capabilities for Linux.

Acknowledgements

The ClamAV team thanks the following individuals for their code submissions:

• Andreas Schulze
• Anthony Chan
• Bill Parker
• Chris Miserva
• Daniel J. Luke
• Georgy Salnikov
• James Ralston
• Jonas Zaddach
• Keith Jones
• Marc Deslauriers
• Mark Allan
• Matthew Boedicker
• Michael Pelletier
• Ningirsu
• Sebastian Andrzej Siewior
• Stephen Welker
• Tuomo Soini

Known Issues

ClamAV has an active issue queue and enjoys continual improvement but as sad as
 I am to say it, we couldn't address every bug in this release.  I want to draw
 your attention a couple bugs in particular so as not to frustrate users
 setting up ClamAV:

• Platform: macOS:
• Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call.

• Platform: CentOS 6 32bit, older versions of AIX:
• Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib.

• Platform: Miscellaneous
• Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.

ClamAV Mirror improvements

Community --

Over the next several weeks, you are going to see some changes made to our ClamAV mirror infrastructure.  This shouldn't result in any outages or issues, but will improve the reliability of  downloads.

You may see mirrors fall out of rotation, and new ones inserted.  This is intentional.  If there are any questions, or issues, please address them on the ClamAV-Mirrors list.

Thank you for your patience.

Installing ClamAV from source: New Documentation!

Hey everyone,

I wanted to point everyone to a git repository, located here.

I'm pointing this out because if you navigate to the 'manual' folder, you will now see new directories and such. The most important thing you will see is "Installation from source" guides for various operating systems. 

This is where we want your assistance. I started the documents, but am asking for any community help to continuously maintain these in markdown. We want to have better documentation moving forward to help new and existing users.

I will also be updating these as newer versions come out. But, it would also be helpful from a community standpoint to have another set of eyes to make sure they are accurate, easy to read and understandable.

Once these are a little more cleaned up, we will be putting them on the website as well.

Keep in mind, these installer guides are "installing from source." Though, I am not opposed to having package maintainers also store documentation here for the ClamAV installer(s) that are created, but that will be their decision. All edits will be reviewed by myself, and then pushed to the repository.

Have a good day!

ClamAV 0.100.0-rc has been posted!

0.100.0-rc (Release Candidate) Notes

ClamAV 0.100.0 is a feature release (candidate) which includes many code submissions from the ClamAV community.  As always, it can be downloaded from our downloads site on clamav.net. Some of the more prominent submissions include:

•  Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
•  Support for Visual Studio 2015 for Windows builds.
•  Support libmspack internal code or as a shared object library. The internal library is the default and contains additional integrity checks.
•  Linking with openssl 1.1.0.
•  Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
•  Numerous bug fixes, typo corrections, and compiler warning fixes.

Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:

• Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: `./configure --with-system-llvm=no`, but it no longer compiles on all platforms.
•  Compute and check PE import table hash (a.k.a. "imphash") signatures.
•  Support file property collection and analysis for MHTML files.
•  Raw scanning of PostScript files.
•  Fix clamsubmit to use the new virus and false positive submission web interface.
•  Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
•  Improved decoders for PDF files.
•  Reduced number of compile time warnings.
•  Improved support for C++11.
•  Improved detection of system installed libraries.
•  Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
•  Improvements to clamd's On-Access scanning capabilities for Linux.

Acknowledgements

The ClamAV team thanks the following individuals for their code submissions:

Andreas Schulze
Anthony Chan
Bill Parker
Chris Miserva
Daniel J. Luke
Georgy Salnikov
James Ralston
Jonas Zaddach
Keith Jones
Marc Deslauriers
Mark Allan
Matthew Boedicker
Michael Pelletier
Ningirsu
Sebastian Andrzej Siewior
Stephen Welker
Tuomo Soini

Known Issues

ClamAV has an active issue queue and enjoys continual improvement but as sad as I am to say it, we couldn't address every bug in this release.  I want to draw your attention a couple bugs in particular so as not to frustrate users setting up ClamAV:

• Platform: macOS: 
• Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call. 
• Platform: CentOS 6 32bit, older versions of AIX:
• Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib. 
•  Platform: Miscellaneous
• Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.

Please check out 0.100.0-rc and provide us feedback on the ClamAV Mailing lists.  As always, a big thank you to the ClamAV Community!

Returning to working form: A Clamsubmit story!

Community -

I wanted to inform everyone of the functionality of ClamAV Clamsubmit

Clamsubmit is a tool that allows you to submit false positives or false negative reporting(s) in ClamAV.

in order to install and use clamsubmit, you will need to install libcurl development packages.

(for example apt-get install libcurl4-openssl-dev)

Clamsubmit:
-e [email]  email address ( required )
-h  shows help text
-N [name] your name ( required )
-n [file] submit false negative(FN)
-p [file] submit false positive(FP)

Example:
clamsubmit -e tmccourt@cisco.com -N Tom McCourt -p /opt/file

You can still use the below submit from the website. The link is below:

https://www.clamav.net/reports/malware

Clamsubmit, at this time, is only available on the *nix systems.  Sorry Windows users!  (We'd love to accept any pull requests to add this functionality!)

If you do use clamsubmit and run into any issues, please enter a ticket.
https://bugzilla.clamav.net/

If ClamAV is not detecting libcurl, when you see the summary output of the ClamAV ./configure,
it will appear like:
configure: Summary of optional tools
              clamsubmit  : no (Please use the web interface for submitting FPs/FNs.)

ClamAV 0.99.4 has been released!

Join us as we welcome ClamAV 0.99.4 to the family!


0.99.4 Release Notes

0.99.4 is a security patch release, quick on the heels of the 0.99.3 security patch release.  This is a renewal of our commitment to the ClamAV community for timely fixes to critical issues.

0.99.4 addresses a few outstanding vulnerability bugs.  It includes fixes for:

• CVE-2012-6706
• CVE-2017-6419
• CVE-2017-11423 
• CVE-2018-1000085 

There are also a few bug fixes that were not assigned CVE’s, but were important enough to address while we had the chance.  One of these was the notorious file descriptor exhaustion bug that caused outages late last January.

In addition to the above, 0.99.4 fixes:

• CVE-2018-0202 
• Two newly reported vulnerabilities in the PDF parsing code. 
• GCC 6, C++11 compatibility issues. 

A big "thank you" to everyone out there contributing patches, bug reports, and helping support the ClamAV community via our mailing lists and IRC channel.

Thank you to the following ClamAV community members for your code submissions and bug reports!

Alberto Garcia
Bernhard Vogel
Francisco Oca
Hanno Böck
Jeffrey Yasskin
Keith Jones
mtowalski
Suleman Ali
yongji.oy
xrym

Stay tuned for the upcoming 0.100.0 release candidate!

ClamAV.net has been upgraded

Community --

Today we completed a large upgrade to the backend of ClamAV.net.  This upgrade should fix several problems that have been occurring on the site, along side of a large software upgrade.  If we did our jobs correctly, you will notice no changes, other than the site simply working better.

Please let us know on bugzilla if you notice any errors.

Thank you!

ClamAV 0.100.0 beta has been released!

ClamAV 0.100.0-beta is the successor to the previous 0.99.3-beta2.  The 0.99.3 patch release on January 25th was required to address vulnerability fixes in a timely manner, so the features previously found in 0.99.3 betas have been bumped to this new version.  If you haven’t read it, please read the announcement regarding the version number change. 

The 0.100.0-beta includes all of the feature improvements and bug fixes that were in the previous 0.99.3-beta2, plus some additional bug fixes and requested improvements that were found by users of the previous beta.  These include:

• Eliminating warnings regarding with variables being used before being initialized. 
• Correcting an issue for those using private mirrors where freshclam attempts to pull down the CVD file if the CLD is up-to-date. 
• Fixed a bug in the filtering system that caused unexpected behavior for signatures that use the case insensitive signatures (:i). 
• Increased the max stack size when building ClamAV for non-glibc Linux machines (i.e. musl). 
• Deprecated the AllowSupplementaryGroups config option in a more graceful way.
• Bug fixes to on-access scanning.
• A few other bug fixes.

We could use community support testing these fixes, of course.  That said, our main goal of 0.100.0-beta is to get the community ready for the version string change.  Mirror maintainers have been asked to verify that ClamAV clients using the 0.100.0 version number in the HTTP user agent are not blacklisted by regexes intended to drop support for older versions of ClamAV.

As a disclaimer, 0.100.0-beta isn’t a release candidate because we have a few outstanding known issues that we must address prior to the 0.100.0 release, and because once the fixes are made we will have to complete regression testing.  The known issues blocking release include the following:

• The libmspack library install location, name. Bug
• BlockMax config option may differ slightly from —block-max command line option. Bug
• Using the ./configure --disable-static will still require llvm-static. Bug
• Improvements in PDF object parsing (in progress). 
• Messages when clamscan skips a file due to max file size settings, along with corrections to the —help string. Bug
• Warnings when building on macOS.  Bugs, Bugs 

Bugs should be brought to our attention via the clamav-devel mailing list or via bugzilla

Update on the recent "File Descriptors" issue in ClamAV

A signature introduced in daily.cvd version 24256 triggered bug that exists in all current stable releases of ClamAV.

The symptoms on a Linux/Unix machine running clamd under heavy load results in the system running out of file descriptors, because the file descriptors for deleted temp files were not being closed.  On Windows systems, a different error occurred wherein the system reported “permission denied” errors when closing (unlinking) the temp files.

The bug was reported as early as April 2016 here: https://bugzilla.clamav.net/show_bug.cgi?id=11549. A patch for this bug was applied towards the upcoming 0.100.0 feature release of ClamAV, but unfortunately the fix didn’t make it into the recent 0.99.3 security patch release.

For the time-being, the offending signature was pulled as of daily.cvd version 24258, and changes to our backend processes have been implemented to prevent this from happening again.

We apologize for the inconvenience this has caused. Future releases of ClamAV will have a fix in place to prevent this issue from reocurring.

ClamAV 0.99.3 has been released!

Join us as we welcome ClamAV 0.99.3 to the family!

As previously mentioned, if you downloaded the beta version of ClamAV 0.99.3, you will need to completely uninstall it and do a fresh install with the production version of 0.99.3 as there are significant code differences.  

Also, please ensure that you read our blog post on ClamAV Version Number Adjustments to ensure that you are staying current with our future plans for releases.

This release is a security release and is recommended for all ClamAV users.  Please see details below:

CVE-2017-12374
1. ClamAV UAF (use-after-free) Vulnerabilities

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations. If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
https://bugzilla.clamav.net/show_bug.cgi?id=11939

CVE-2017-12375
2. ClamAV Buffer Overflow Vulnerability

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L
https://bugzilla.clamav.net/show_bug.cgi?id=11940

CVE-2017-12376
3. ClamAV Buffer Overflow in handle_pdfname Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.

https://bugzilla.clamav.net/show_bug.cgi?id=11942
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2017-12377
4. ClamAV Mew Packet Heap Overflow Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap overflow condition when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11943
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L /A:L

CVE-2017-12378
5. ClamAV Buffer Over Read Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11946
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L

CVE-2017-12379
6. ClamAV Buffer Overflow in messageAddArgument Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11944
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L /A:L

CVE-2017-12380
7. ClamAV Null Dereference Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation checking mechanisms during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition.

https://bugzilla.clamav.net/show_bug.cgi?id=11945
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Also included are 2 minor fixes to properly detect openssl install locations on FreeBSD 11, and prevent false warnings about zlib 1.2.1# version numbers.

Thank you to the following ClamAV community members for your code
submissions and bug reports!

Alberto Garcia
Daniel J. Luke
Francisco Oca
Sebastian A. Siewior
Suleman Ali

Special thanks to Offensive Research at Salesforce.com for responsible disclosure.

As always you can download the latest copy of ClamAV from our website ClamAV.net/downloads

Please continue the discussion on our mailing lists at http://www.clamav.net/contact#ml

ClamAV Version number adjustment

This is a heads up to the ClamAV community, we are changing our version numbering scheme as follows. Our versions will follow x.y.z (major.minor.patch). Major releases will be reserved for major feature additions or changes that may be incompatible with previous releases. Minor releases will be for regular bug fixes and minor feature changes/additions. Patches will be reserved for security fixes to address CVE and other critical bug fixes.

This change was driven by our need to address a security vulnerability release to resolve a number of CVEs which will be published shortly. We internally discussed a number of options, and reviewed these options with a few key members of the community before making this decision.

What this means for our community members? We will shortly be releasing a 0.99.3 release. This release will specifically target the aforementioned CVEs. The 0.99.3 betas we had previously shared will be renumbered to 0.100.0 instead.

We apologize for any confusion this change will cause, but we feel this will impact the least number of community members, while allowing us flexibility to quickly address critical bugs or security issues, without undue issues with other work underway.

ClamAV List Server Upgrade

Tomorrow (10/Jan/2018) at 9:00 EST, we will be upgrading the ClamAV Mailman list hosting server.

This will result in the clamav-users, clamav-devel, community-sigs, clamav-virusdb, etc will be down during the outage.  We will send a notification via the lists, blog, Twitter, and Facebook when the server is back up.

Thanks for your patience during our maintenance!


Update:  The list servers have been upgraded.