Update on the recent "File Descriptors" issue in ClamAV

A signature introduced in daily.cvd version 24256 triggered bug that exists in all current stable releases of ClamAV.

The symptoms on a Linux/Unix machine running clamd under heavy load results in the system running out of file descriptors, because the file descriptors for deleted temp files were not being closed.  On Windows systems, a different error occurred wherein the system reported “permission denied” errors when closing (unlinking) the temp files.

The bug was reported as early as April 2016 here: https://bugzilla.clamav.net/show_bug.cgi?id=11549. A patch for this bug was applied towards the upcoming 0.100.0 feature release of ClamAV, but unfortunately the fix didn’t make it into the recent 0.99.3 security patch release.

For the time-being, the offending signature was pulled as of daily.cvd version 24258, and changes to our backend processes have been implemented to prevent this from happening again.

We apologize for the inconvenience this has caused. Future releases of ClamAV will have a fix in place to prevent this issue from reocurring.

ClamAV 0.99.3 has been released!

Join us as we welcome ClamAV 0.99.3 to the family!

As previously mentioned, if you downloaded the beta version of ClamAV 0.99.3, you will need to completely uninstall it and do a fresh install with the production version of 0.99.3 as there are significant code differences.  

Also, please ensure that you read our blog post on ClamAV Version Number Adjustments to ensure that you are staying current with our future plans for releases.

This release is a security release and is recommended for all ClamAV users.  Please see details below:

CVE-2017-12374
1. ClamAV UAF (use-after-free) Vulnerabilities

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations. If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
https://bugzilla.clamav.net/show_bug.cgi?id=11939

CVE-2017-12375
2. ClamAV Buffer Overflow Vulnerability

The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L
https://bugzilla.clamav.net/show_bug.cgi?id=11940

CVE-2017-12376
3. ClamAV Buffer Overflow in handle_pdfname Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code.

https://bugzilla.clamav.net/show_bug.cgi?id=11942
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2017-12377
4. ClamAV Mew Packet Heap Overflow Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap overflow condition when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11943
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L /A:L

CVE-2017-12378
5. ClamAV Buffer Over Read Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11946
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N /A:L

CVE-2017-12379
6. ClamAV Buffer Overflow in messageAddArgument Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.

The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device.

https://bugzilla.clamav.net/show_bug.cgi?id=11944
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L /A:L

CVE-2017-12380
7. ClamAV Null Dereference Vulnerability

ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation checking mechanisms during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition.

https://bugzilla.clamav.net/show_bug.cgi?id=11945
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Also included are 2 minor fixes to properly detect openssl install locations on FreeBSD 11, and prevent false warnings about zlib 1.2.1# version numbers.

Thank you to the following ClamAV community members for your code
submissions and bug reports!

Alberto Garcia
Daniel J. Luke
Francisco Oca
Sebastian A. Siewior
Suleman Ali

Special thanks to Offensive Research at Salesforce.com for responsible disclosure.

As always you can download the latest copy of ClamAV from our website ClamAV.net/downloads

Please continue the discussion on our mailing lists at http://www.clamav.net/contact#ml

ClamAV Version number adjustment

This is a heads up to the ClamAV community, we are changing our version numbering scheme as follows. Our versions will follow x.y.z (major.minor.patch). Major releases will be reserved for major feature additions or changes that may be incompatible with previous releases. Minor releases will be for regular bug fixes and minor feature changes/additions. Patches will be reserved for security fixes to address CVE and other critical bug fixes.

This change was driven by our need to address a security vulnerability release to resolve a number of CVEs which will be published shortly. We internally discussed a number of options, and reviewed these options with a few key members of the community before making this decision.

What this means for our community members? We will shortly be releasing a 0.99.3 release. This release will specifically target the aforementioned CVEs. The 0.99.3 betas we had previously shared will be renumbered to 0.100.0 instead.

We apologize for any confusion this change will cause, but we feel this will impact the least number of community members, while allowing us flexibility to quickly address critical bugs or security issues, without undue issues with other work underway.

ClamAV List Server Upgrade

Tomorrow (10/Jan/2018) at 9:00 EST, we will be upgrading the ClamAV Mailman list hosting server.

This will result in the clamav-users, clamav-devel, community-sigs, clamav-virusdb, etc will be down during the outage.  We will send a notification via the lists, blog, Twitter, and Facebook when the server is back up.

Thanks for your patience during our maintenance!


Update:  The list servers have been upgraded.

ClamAV 0.99.3 beta2 has been released!

Welcome to ClamAV 0.99.3's beta2 release. In this release, we have included many code
submissions from the ClamAV community:

• Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
• Visual Studio 2015 for building Microsoft Windows binaries.
• Support libmspack internal code or as a shared object library. The internal library is the default and contains additional integrity checks.
• Linking with openssl 1.1.0.
• Numerous code patches, typos, and compiler warning fixes.

Additionally, we have introduced important changes and new features in
ClamAV 0.99.3, including:

• Deprecating internal LLVM code support. The configure script has change to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: './configure --with-system-llvm=no', but it no longer compiles on all platforms.
• Compute and check PE import table hash (a.k.a. "imphash") signatures.
• Support file property collection and analysis for MHTML files.
• Raw scanning of PostScript files.
• Fix clamsubmit to use the new virus and false positive submission web interface.
• Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
• Improve decoders for PDF files.

The ClamAV community thanks the following individuals for their ClamAV 0.99.3
code submissions:

Sebastian Andrzej Siewior
Keith Jones
Bill Parker
Chris Miserva
Daniel J. Luke
Matthew Boedicker
Ningirsu
Michael Pelletier
Anthony Chan
Stephen Welker
Marc Deslauriers
Mark Allan
Andreas Schulze
Jonas Zaddach
Georgy Salnikov

We are releasing beta2 for further testing while we resolve our small list of known issues in the background as we are prepping for "General Availability".  If you have the ability to download and use beta2 on your network, please do.  Thanks!

Mirror Sync Outage for ClamAV AV updates

ClamAV Community --

ClamAV is currently experiencing an issue with one of our sync servers that provides updates from our infrastructure out to the ClamAV mirrors.

Since end-users receive their updates from the ClamAV mirrors, this means that currently, ClamAV AV updates are currently not available.

Our operations team is currently working on the issue, and we will provide updates as needed.

ClamAV introduction and survey reminder!

Hello everyone! My name is Tom McCourt, a newer member to ClamAV on Joel Esler’s team here at Cisco. I hope the community is doing great. I wanted to inform everyone that a survey was created to help gather some information on operating systems and provide some feedback. Here on the ClamAV team, we want to be able to determine what operating systems are being used as well as with what architecture to better maximize our development cycles by increasing our releases, and making ClamAV a better product overall. To do this, we need your help!

The survey can be found at the link below:

https://www.research.net/r/WZH2NL5

There is about 2 weeks left for the survey before we close it out, so be sure to help and submit some information. I will be idling the #clamav IRC chatroom to hopefully assist or talk to the community on what they want to see in the future of the product.

irc info:
irc.freenode.net
#clamav

My name on IRC is Wookiee

ClamAV Customer Feedback Survey

As we are ramping up the feature planning on the next version of ClamAV, and with the recent turmoil that we've overcome (for the most part) with the mirror system.  We decided it would be a fantastic idea to send out a survey to the ClamAV community to gather your thoughts on what you'd like to see in the engine.


We have a lot of fantastic ideas and goals ourselves on making ClamAV more reliable, easier to install, and better to use -- but we want to hear from you!

https://www.research.net/r/WZH2NL5

Please take a look at this survey over on SurveyMonkey, and please give us feedback!

CVD Download issues for August 23, 2017

This morning, we became aware of an issue with our ClamAV mirror infrastructure that was causing some freshclam instances to fail when trying to download the current updates.

This was a result of one of our mirror sync hosts experiencing an issue.  This was resolved by stopping and restarting all services on the machine.

Currently the sync server is healthy, and all requests should be handled normally.

We apologize for any inconvenience this may have caused, and are working to prevent this from occurring in the future.

ClamAV 0.99.3 beta has been released!

Join us as we welcome ClamAV 0.99.3 beta for testing!  Be sure and grab the beta release on our official ClamAV download site.

Welcome to ClamAV 0.99.3. In this release, we have included many code
submissions from the ClamAV community:

• Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
• Visual Studio 2015 for building Microsoft Windows binaries.
• Support libmspack internal code or as a shared object library. The internal library is the default and contains additional integrity checks.
• Linking with openssl 1.1.0.
• Numerous code patches, typos, and compiler warning fixes.

Additionally, we have introduced important changes and new features in
ClamAV 0.99.3, including:

• Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: './configure --with-system-llvm=no', but it no longer compile on all platforms.
• Compute and check PE import table hash (a.k.a. "imphash") signatures.
• Support file property collection and analysis for MHTML files.
• Raw scanning of PostScript files.
• Fix clamsubmit to use the new virus and false positive submission web interface.
• Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
• Improve decoders for PDF files.

The ClamAV community thanks the following individuals for their ClamAV 0.99.3 code submissions:

Sebastian Andrzej Siewior
Keith Jones
Bill Parker
Chris Miserva
Daniel J. Luke
Matthew Boedicker
Ningirsu
Michael Pelletier
Anthony Chan
Stephen Welker

Following are issues discovered during release testing. For additional information, please review the corresponding tickets on bugzilla.clamav.net:

11879 - cli_scanmscan() Failed to extract 4 in Windows beta when scanning cab files
11882 - ./configure does not automatically detect libxml2 on FreeBSD 10.3 and 11.0
11884 - 'sudo make install' on FreeBSD 10.3 and 11.0 leaves files owned by root, subsequent make command fails
11885 - clamsubmit not building on FreeBSD 10.3 and 11.0
11887 - Failures of 'make check VG=1' on FreeBSD 10.3 and 11.0

We ask that feedback be provided via the ClamAV mailing lists.