ClamAV Vulnerabilities

Report bugs and workarounds
henk
Posts: 336
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: ClamAV 0.100.0 available

Post by henk » 14 Jul 2018 21:38

As there is already version 0.100.1, upgrading to 0.100.0 is still recommended. It contains many code submissions from the ClamAV community.
https://github.com/Cisco-Talos/clamav-d ... 1/NEWS.md
My upgrade steps.

Check for updates

Code: Select all

yum check-update
Make backup :lol:

As I dont like cronjobs during the upgrade ( stop the mailflow) and stop clam

Code: Select all

service crond stop
service clamd stop
upgrade

Code: Select all

yum upgrade
Remove old database

Code: Select all

rm /var/lib/clamav/daily.cld
Get new dbs

Code: Select all

freshclam -v
sa-update -v
To get rid of yara related errors. ( you can always enable it again)
/etc/clamav-unofficial-sigs/master.conf

Code: Select all

yararulesproject_enabled="no"
enable_yararules="no"
And delete or move to backup dir from /var/lib/clamav/

Code: Select all

rm /var/lib/clamav/*yar
rm /var/lib/clamav/*yara  
Check clamd.conf and freshclam.conf for custom and depricated settings
warning: /etc/clamd.conf created as /etc/clamd.conf.rpmnew
warning: /etc/freshclam.conf created as /etc/freshclam.conf.rpmnew

Code: Select all

service clamd start
reboot to check it all ( new kernel?)

check the logs :violin:

henk
Posts: 336
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Clamav 100.1-1 - ClamAV Vulnerabilities

Post by henk » 25 Jul 2018 07:26

Clamav 100.1-1 available.

Code: Select all

yum list clamav
Installed Packages
clamav.x86_64 0.100.0-1.el6 @epel
Available Packages
clamav.i686 0.100.1-1.el6 epel
clamav.x86_64 0.100.1-1.el6 epel

after update: run

Code: Select all

freshclam -v
and

Code: Select all

sa-update -v
check clamav

Code: Select all

service clamd restart
Stopping Clam AntiVirus Daemon:                            [  OK  ]
Starting Clam AntiVirus Daemon:                            [  OK  ]
[

dwmp
Posts: 49
Joined: 05 Feb 2016 13:42

Re: ClamAV Vulnerabilities

Post by dwmp » 30 Jul 2018 08:32

Hello,

I tried to install the updates without success, what I did:
- disable mail income, create backup
- comment the line

Code: Select all

#exclude=kernel* postfix* mailscanner* MailScanner* clamav* clamd* open-vm-tools*

Code: Select all

service crond stop

Code: Select all

sudo yum update
- Reboot
- Installing Webmin update
- Reboot
=> While booting I saw some ClamAV-related erros, also I got some error notifications "service <postfix/httpd/mysql/clamd> down and restarted..." (the notification for clamd came 3 times). So I did the following:

Code: Select all

service crond stop
service clamd stop
rm /var/lib/clamav/daily.cld
freshclam -v
sa-update –v
service clamd start
- Reboot
- Everything seemed fine, boot errors regarding clamav were still there but I "realized" they have been there before the updates without making problems
- I enabled mail income + wrote some test mails
=> the first came properly through, the second (and also another incoming mail) one appeared in in MailWatch but didn't come to my Outlook. After a moment the message appeared again in the MailWatch-list, that went on every few seconds so after a few minutes I had great list in MailWatch including those two emails appearing again and again (but without releasing them to the mailboxes in the mailserver)
=> So I shut down EFA again and restored the backup/snapshot, so now it is running again (but old versions of course).

I saved the corrupt state and now I am trying to find out what the problem was, to execute the update again (and this time properly).
I viewed some logs but I didn't get a hint what the reason might be. Wenn I shut it down it says FAILED when trying to stop the Clamav service.
Has someone an idea what to do?
Thanks!

BR
dwmp

henk
Posts: 336
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: ClamAV Vulnerabilities

Post by henk » 30 Jul 2018 08:37

Seems you missed some steps in this post

to get rid of yara related errors. ( you can always enable it again)
/etc/clamav-unofficial-sigs/master.conf

yararulesproject_enabled="no"
enable_yararules="no"

And delete or move to backup dir from /var/lib/clamav/

Code: Select all

rm /var/lib/clamav/*yar
rm /var/lib/clamav/*yara

dwmp
Posts: 49
Joined: 05 Feb 2016 13:42

Re: ClamAV Vulnerabilities

Post by dwmp » 08 Aug 2018 05:43

Thank you! I will try that.
Do you think that the problem (that mails are not coming through Outlook and reappearing in Mailwatch list) will also be resolved with your recommendation?
Or is it only for the boot-error-messages?

henk
Posts: 336
Joined: 14 Dec 2015 22:16
Location: Netherlands
Contact:

Re: ClamAV Vulnerabilities

Post by henk » 08 Aug 2018 08:48

I quess you will find the answer in this post viewtopic.php?f=14&p=12615#p12615 :)

dwmp
Posts: 49
Joined: 05 Feb 2016 13:42

Re: ClamAV Vulnerabilities

Post by dwmp » 23 Oct 2018 05:25

Thank you very much, it worked!

Post Reply