ClamAV® blog: ClamAV 0.103 .0 released!
"Joel Esler (jesler)" <[email protected]> Mon, 14 Sep 2020 13:36:56 +0000
| Newsgroups | gmane.comp.security.virus.clamav.announce,gmane.comp.security.virus.clamav.win32,gmane.comp.security.virus.clamav.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============4991801428997552128==
Content-Language: en-US
Content-Type: multipart/signed;
boundary="Apple-Mail=_DAD95768-D11F-445E-96A6-8BD94FCFFD59";
protocol="application/pkcs7-signature";
micalg=sha-256
--Apple-Mail=_DAD95768-D11F-445E-96A6-8BD94FCFFD59
Content-Type: multipart/alternative;
boundary="Apple-Mail=_E9AE7CEA-1156-468E-AC68-1B75BF2A4B52"
--Apple-Mail=_E9AE7CEA-1156-468E-AC68-1B75BF2A4B52
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
>=20
> https://blog.clamav.net/2020/09/clamav-01030-released.html =
<https://blog.clamav.net/2020/09/clamav-01030-released.html>
>=20
> ClamAV 0.103.0 released!
>=20
> Please visit the ClamAV Downloads page =
<https://www.clamav.net/downloads> to get your copy now!
>=20
> ClamAV 0.103.0 highlights
>=20
> With your feedback on the previous candidates, we've fixed these =
additional issues:
>=20
> The freshclam PID file was not readable by other users in the release =
candidates, but is now readable by all.
> An issue with how freshclam was linked with the autotools build system =
caused SysLog settings to be ignored
> The real-path checks introduced to clamscan and clamdscan in 0.102.4 =
broke scanning of some files with unicode filenames and files on network =
shares for Windows users.
> Thanks for your help!
> Major changes
>=20
> clamd can now reload the signature database without blocking scanning. =
This multi-threaded database reload improvement was made possible thanks =
to a community effort.
> Non-blocking database reloads are now the default behavior. Some =
systems that are more constrained on RAM may need to disable =
non-blocking reloads as it will temporarily consume two times as much =
memory. We added a new clamd config option ConcurrentDatabaseReload, =
which may be set to no.
> Special thanks to who made this feature a reality:
> Alberto Wu
> Alexander Sulfrian
> Arjen de Korte
> David Heidelberg
> Ged Haywood
> Julius Plenz
> Michael Orlitzky
> Thank you all for your patience in waiting for this feature.
>=20
> Notable changes
>=20
> The DLP module has been enhanced with additional credit card ranges =
and a new engine option that allows ClamAV to alert only on credit cards =
(and not, for instance, gift cards) when scanning with the DLP module. =
John Schember developed this feature, with input from Alexander =
Sulfrian.
> Support for Adobe Reader X PDF encryption, an overhaul of PNG scanning =
to detect PNG specific exploits, and a major change to GIF parsing, =
which makes it more tolerant to problematic files and adds the ability =
to scan overlays, all thanks to work and patches submitted by Aldo =
Mazzeo.
> clamdtop.exe now available for Windows users. Functionality is =
somewhat limited when compared to clamdtop on Linux. PDCurses is =
required to build clamdtop.exe for ClamAV on Windows.
> The phishing detection module will now print "Suspicious link found!" =
along with the "Real URL" and "Display URL" each time phishing is =
detected. In a future version, we would like to print out alert-related =
metadata like this at the end of a scan, but for now, this detail will =
help users understand why a given file is being flagged as phishing.
> Added new *experimental* CMake build tooling. CMake is not yet =
recommended for production builds. Our team would appreciate any =
assistance improving the CMake build tooling so we can one day deprecate =
Autotools and remove the Visual Studio solutions.
> Please see the new CMake installation instructions found in =
INSTALL.cmake.md for detailed instructions on how to build ClamAV with =
CMake.
> Added --ping and --wait options to the clamdscan and clamonacc client =
applications.
> The --ping (-p) command will attempt to ping clamd up to a specified =
maximum number of attempts at an optional interval. If the interval =
isn't specified, a default 1-second interval is used. It will exit with =
status code `0` when it receives a PONG from clamd or status code `21` =
if the timeout expires before it receives a response.
> Example:
> clamdscan -p 120 will attempt to ping clamd 120 at a 1 second =
interval.
> The --wait (-w) command will wait up to 30 seconds for clamd to start. =
This option may be used in tandem with the --ping option to customize =
the max # of attempts and the attempt interval. As with --ping, the =
scanning client may exit with status code 21 if the timeout expires =
before a connection is made to clamd.
> Example:
> clamdscan -p 30:2 -w <file> will attempt a scan, waiting up to 60 =
seconds for clamd to start and receive the scan request.
> The ping-and-wait feature is particularly useful for those wishing to =
start clamd and start clamonacc at startup, ensuring that clamd is ready =
before clamonacc starts. It is also useful for those wishing to start =
clamd immediately before initiating scans with clamdscan rather than =
having the clamd service run continuously.
> Added Excel 4.0 (XLM) macro detection and extraction support. =
Significantly improved VBA detection and extraction as well. Work =
courtesy of Jonas Zaddach.
> This support not yet added to sigtool, as the VBA extraction feature =
in sigtool is separate from the one used for scanning and will still =
need to be updated or replaced in the future.
> Improvements to the layout and legibility of temp files created during =
a scan. Improvements to legibility and content of the metadata JSON =
generated during a scan.
> To review the scan temp files and metadata JSON, run:
>=20
> clamscan --tempdir=3D<path> --leave-temps --gen-json <target>
>=20
> Viewing the scan temp files and metadata.json file provides some =
insight into how ClamAV analyzes a given file and can also be useful to =
analysts for the initial triage of potentially malicious files.
> Other improvements
>=20
> Added ability for freshclam and clamsubmit to override default use of =
OpenSSL CA bundle with a custom CA bundle. On Linux/Unix platforms =
(excluding macOS), users may specify a custom CA bundle by setting the =
CURL_CA_BUNDLE environment variable. On macOS and Windows, users are =
expected to add CA certificates to their respective system's =
keychain/certificate store. Patch courtesy of Sebastian A. Siewior
> clamscan and clamdscan now print the scan start and end dates in the =
scan summary.
> The clamonacc on-access scanning daemon for Linux now installs to sbin =
instead of bin.
> Improvements to the freshclam progress bar so the width of the text =
does not shift around as information changes and will not spill exceed =
80 characters, even on very slow connections. Time is now displayed in =
Xm XXs (or Xh XXm) for values of 60 seconds or longer. Bytes display now =
changes units at the proper 1024 B/KiB instead of 2048 B/KiB. Patch =
courtesy of Zachary Murden.
> Improve column alignment and line wrap rendering for clamdtop. Also =
fixed an issue on Windows where clamdtop would occasionally disconnect =
from clamd and fail to reconnect. Patch courtesy of Zachary Murden.
> Improvements to the AutoIT parser.
> Loosened the curl version requirements in order to build and use =
clamonacc. You may now build ClamAV with any version of libcurl. However =
clamonacc's file descriptor-passing (FD-passing) capability will only be =
available with libcurl 7.40 or newer. FD-passing is ordinarily the =
default way to perform scans with clamonacc as it is significantly =
faster than streaming.
> Added LZMA and BZip2 decompression routines to the bytecode signature =
API.
> Disabled embedded type recognition for specific archive and disk image =
file types. This change reduces file type misclassification and improves =
scan time performance by reducing duplicated file scanning.=20
> Use pkg-config to detect libpcre2-8 before resorting to pcre2-config =
or pcre-config.
> Patch courtesy of Michael Orlitzky.
> Bug fixes
>=20
> Fixed issue scanning directories on Windows with clamdscan.exe that =
was introduced when mitigating against symlink quarantine attacks.
> Fixed behavior of freshclam --quiet option. Patch courtesy of Reio =
Remma.
> Fixed behavior of freshclam's OnUpdateExecute, OnErrorExecute, and =
OnOutdatedExecute config options on Windows when in daemon-mode so it =
can handle multiple arguments. Patch courtesy of Zachary Murden.
> Fixed an error in the heuristic alert mechanism that would cause a =
single detection within an archive to alert once for every subsequent =
file scanned, potentially resulting in thousands of alerts for a single =
scan.
> Fixed clamd, clamav-milter, and freshclam to create PID files before =
dropping privileges, to avoid the possibility of an unprivileged user =
from changing the PID file so that a service manager will kill a =
different process. This change does make the services unable to clean up =
the PID file on exit.
> Fixed the false positive (.fp) signature feature. In prior versions, =
the hash in a false positive signature would be checked only against the =
current layer of a file being scanned. In 0.103, every file layer is =
hashed, and the hashes for each in the scan recursion list are checked. =
This ensures that .fp signatures containing a hash for any layer in the =
scan leading up to the alert will negate the alert.
> As an example, a hash for a zip containing the file which alerts would =
not prevent the detection in prior versions. Only the hash of the =
embedded file would work. For some file types where the outermost is =
always an archive, eg. docx files, this made .fp signatures next to =
useless. For certain file types where the scanned content was a =
normalized version of the original content, eg. HTML, the normalized =
version was never hashed and this meant that .fp signatures never =
worked.
> Fixed Trusted & Revoked Windows executable (PE) file signature rules =
(.crb) maximum functionality level (FLEVEL) which had been being treated =
as the minimum FLEVEL. These signatures enable ClamAV to trust =
executables that are digitally signed by trusted publishers, or to alert =
on executables signed with compromised signing-certificates. The minimum =
and maximum FLEVELS enable or disable signatures at load time depending =
on the current ClamAV version.
> Fixed a bug wherein you could not build ClamAV with =
--enable-libclamav-only if curl was not installed on the system.
> Various other bug fixes, improvements, and documentation improvements.
> New Requirements
>=20
> Autotools (automake, autoconf, m4, pkg-config, libtool) are now =
required in order to build from a Git clone because the files generated =
by these tools have been removed from the Git repository. To generate =
theses files before you compile ClamAV, run autogen.sh. Users building =
with Autotools from the release tarball should be unaffected.
> Acknowledgments
>=20
> The ClamAV team thanks the following individuals for their code =
submissions:
>=20
> Aldo Mazzeo
> =C3=81ngel
> Antonino Cangialosi
> Clement Lecigne
> Jamie Biggar
> Jan Smutny
> Jim Klimov=20
> John Schember
> Jonathan Sabbe
> lutianxiong
> Michael Orlitzky=20
> Reio Remma
> Sebastian A. Siewior
> Zachary Murden=20
>=20
--Apple-Mail=_E9AE7CEA-1156-468E-AC68-1B75BF2A4B52
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base=
class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass"><br =
class=3D""></div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><div class=3D""><div =
class=3D"original-url"><br class=3D""><a =
href=3D"https://blog.clamav.net/2020/09/clamav-01030-released.html" =
class=3D"">https://blog.clamav.net/2020/09/clamav-01030-released.html</a><=
br class=3D""><br class=3D""></div><div id=3D"article" role=3D"article" =
style=3D"font-family: Georgia; text-rendering: optimizeLegibility; =
font-size: 1.2em; line-height: 1.5em; margin: 0px; padding: 0px;" =
class=3D"georgia exported">
<!-- This node will contain a number of div.page. -->
<div class=3D"page" style=3D"word-wrap: break-word; max-width: =
100%;"><h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: =
1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: =
100%;">ClamAV 0.103.0 released!</h1><p style=3D"max-width: 100%;" =
class=3D"">Please visit the <a href=3D"https://www.clamav.net/downloads" =
target=3D"_blank" style=3D"color: rgb(73, 129, 254); max-width: 100%;" =
class=3D"">ClamAV Downloads page</a> to get your copy now! </p><h3 =
style=3D"font-size: 1.25em; max-width: 100%;" class=3D"">ClamAV 0.103.0 =
highlights</h3><p style=3D"max-width: 100%;" class=3D"">With your =
feedback on the previous candidates, we've fixed these additional =
issues:</p><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">The <span style=3D"max-width: =
100%;" class=3D"">freshclam</span> PID file was not readable by other =
users in the release candidates, but is now readable by all.</li><li =
style=3D"max-width: 100%;" class=3D"">An issue with how <span =
style=3D"max-width: 100%;" class=3D"">freshclam</span> was linked with =
the autotools build system caused SysLog settings to be ignored </li><li =
style=3D"max-width: 100%;" class=3D"">The real-path checks introduced to =
<span style=3D"max-width: 100%;" class=3D"">clamscan</span> and <span =
style=3D"max-width: 100%;" class=3D"">clamdscan</span>
in 0.102.4 broke scanning of some files with unicode filenames and=20
files on network shares for Windows users.</li></ul>Thanks for your =
help!<h2 style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">Major =
changes</h2><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" =
class=3D"">clamd</span>
can now reload the signature database without blocking =
scanning. This=20
multi-threaded database reload improvement was made possible thanks to a
community effort.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Non-blocking database reloads are =
now the
default behavior. Some systems that are more constrained on RAM =
may=20
need to disable non-blocking reloads as it will temporarily consume =
two=20
times as much memory. We added a new <span style=3D"max-width: =
100%;" class=3D"">clamd</span> config option <span =
style=3D"max-width: 100%;" class=3D"">ConcurrentDatabaseReload,</span> =
which may be set to <span style=3D"max-width: 100%;" =
class=3D"">no</span>.</li></ul></ul>Special thanks to who made this =
feature a reality:<br style=3D"max-width: 100%;" class=3D""><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Alberto Wu</li><li style=3D"max-width: 100%;" =
class=3D"">Alexander Sulfrian</li><li style=3D"max-width: 100%;" =
class=3D"">Arjen de Korte</li><li style=3D"max-width: 100%;" =
class=3D"">David Heidelberg</li><li style=3D"max-width: 100%;" =
class=3D"">Ged Haywood</li><li style=3D"max-width: 100%;" =
class=3D"">Julius Plenz</li><li style=3D"max-width: 100%;" =
class=3D"">Michael Orlitzky</li></ul><p style=3D"max-width: 100%;" =
class=3D"">Thank you all for your patience in waiting for this =
feature.</p><h2 style=3D"font-size: 1.43em; max-width: 100%;" =
class=3D"">Notable changes</h2><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">The
DLP module has been enhanced with additional credit card ranges and a=20=
new engine option that allows ClamAV to alert only on credit cards =
(and=20
not, for instance, gift cards) when scanning with the DLP module. =
John=20
Schember developed this feature, with input from Alexander =
Sulfrian.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Support
for Adobe Reader X PDF encryption, an overhaul of PNG scanning=20
to detect PNG specific exploits, and a major change to GIF parsing,=20=
which makes it more tolerant to problematic files and adds the =
ability=20
to scan overlays, all thanks to work and patches submitted by Aldo=20=
Mazzeo.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" =
class=3D"">clamdtop.exe</span> now available for Windows users. =
Functionality is somewhat limited when compared to <span =
style=3D"max-width: 100%;" class=3D"">clamdtop</span> on Linux. PDCurses =
is required to build <span style=3D"max-width: 100%;" =
class=3D"">clamdtop.exe</span> for ClamAV on Windows.</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">The
phishing detection module will now print "Suspicious link found!"=20
along with the "Real URL" and "Display URL" each time phishing is=20=
detected. In a future version, we would like to print out =
alert-related=20
metadata like this at the end of a scan, but for now, this detail =
will=20
help users understand why a given file is being flagged as =
phishing.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Added new *<i style=3D"max-width: =
100%;" class=3D"">experimental</i>* CMake build tooling. CMake is not =
yet recommended for production builds. <i style=3D"max-width: 100%;" =
class=3D"">Our
team would appreciate any assistance improving the CMake build =
tooling=20
so we can one day deprecate Autotools and remove the Visual Studio=20=
solutions</i>.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Please see the new CMake =
installation instructions found in <span style=3D"max-width: 100%;" =
class=3D"">INSTALL.cmake.md</span> for detailed instructions on how to =
build ClamAV with CMake.</li></ul></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Added <span =
style=3D"max-width: 100%;" class=3D"">--ping</span> and <span =
style=3D"max-width: 100%;" class=3D"">--wait</span> options to the <span =
style=3D"max-width: 100%;" class=3D"">clamdscan</span> and <span =
style=3D"max-width: 100%;" class=3D"">clamonacc</span> =
client applications.</li><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">The <span =
style=3D"max-width: 100%;" class=3D"">--ping</span> (<span =
style=3D"max-width: 100%;" class=3D"">-p</span>) command will attempt to =
ping <span style=3D"max-width: 100%;" class=3D"">clamd</span>
up to a specified maximum number of attempts at an optional =
interval.=20
If the interval isn't specified, a default 1-second interval is =
used. It
will exit with status code `<span style=3D"max-width: 100%;" =
class=3D"">0</span>` when it receives a <span style=3D"max-width: 100%;" =
class=3D"">PONG</span> from <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> or status code `<span style=3D"max-width: 100%;" =
class=3D"">21</span>` if the timeout expires before it receives a =
response.</li></ul></ul>Example:<br style=3D"max-width: 100%;" =
class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" =
class=3D"">clamdscan -p 120</span> will attempt to ping <span =
style=3D"max-width: 100%;" class=3D"">clamd</span> 120 at a 1 second =
interval.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">The <span style=3D"max-width: =
100%;" class=3D"">--wait</span> (<span style=3D"max-width: 100%;" =
class=3D"">-w</span>) command will wait up to 30 seconds for <span =
style=3D"max-width: 100%;" class=3D"">clamd</span> to start. This =
option may be used in tandem with the <span style=3D"max-width: 100%;" =
class=3D"">--ping</span> option to customize the max # of attempts and =
the attempt interval. As with <span style=3D"max-width: 100%;" =
class=3D"">--ping</span>, the scanning client may exit with status code =
<span style=3D"max-width: 100%;" class=3D"">21</span> if the timeout =
expires before a connection is made to <span style=3D"max-width: 100%;" =
class=3D"">clamd</span>.</li></ul></ul>Example:<br style=3D"max-width: =
100%;" class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" =
class=3D"">clamdscan -p 30:2 -w <<i style=3D"max-width: 100%;" =
class=3D"">file</i>></span> will attempt a scan, waiting up to 60 =
seconds for <span style=3D"max-width: 100%;" class=3D"">clamd</span> =
to start and receive the scan request.</li><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">The =
ping-and-wait feature is particularly useful for those wishing to =
start <span style=3D"max-width: 100%;" class=3D"">clamd</span> and =
start <span style=3D"max-width: 100%;" class=3D"">clamonacc</span> at =
startup, ensuring that <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> is ready before <span style=3D"max-width: =
100%;" class=3D"">clamonacc</span> starts. It is also useful for those =
wishing to start <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> immediately before initiating scans with <span =
style=3D"max-width: 100%;" class=3D"">clamdscan</span> rather =
than having the <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> service run continuously.</li></ul></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Added
Excel 4.0 (XLM) macro detection and extraction support.=20
Significantly improved VBA detection and extraction as well. Work=20=
courtesy of Jonas Zaddach.</li><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">This support not =
yet added to <span style=3D"max-width: 100%;" class=3D"">sigtool</span>, =
as the VBA extraction feature in <span style=3D"max-width: 100%;" =
class=3D"">sigtool</span> is separate from the one used for scanning and =
will still need to be updated or replaced in the =
future.</li></ul></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Improvements
to the layout and legibility of temp files created during a scan.=20
Improvements to legibility and content of the metadata JSON generated=20
during a scan.</li></ul>To review the scan temp files and metadata JSON, =
run:<br style=3D"max-width: 100%;" class=3D""><br style=3D"max-width: =
100%;" class=3D""> <span style=3D"max-width: 100%;" =
class=3D"">clamscan --tempdir=3D<<i style=3D"max-width: 100%;" =
class=3D"">path</i>> --leave-temps --gen-json <<i =
style=3D"max-width: 100%;" class=3D"">target</i>></span><br =
style=3D"max-width: 100%;" class=3D""><br style=3D"max-width: 100%;" =
class=3D"">Viewing the scan temp files and <span style=3D"max-width: =
100%;" class=3D"">metadata.json</span>
file provides some insight into how ClamAV analyzes a given file =
and=20
can also be useful to analysts for the initial triage of potentially=20
malicious files.<br style=3D"max-width: 100%;" class=3D""><h2 =
style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">Other =
improvements</h2><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Added ability for <span =
style=3D"max-width: 100%;" class=3D"">freshclam</span> and <span =
style=3D"max-width: 100%;" class=3D"">clamsubmit</span>
to override default use of OpenSSL CA bundle with a custom CA =
bundle.=20
On Linux/Unix platforms (excluding macOS), users may specify a =
custom CA
bundle by setting the <span style=3D"max-width: 100%;" =
class=3D"">CURL_CA_BUNDLE</span>
environment variable. On macOS and Windows, users are expected to =
add=20
CA certificates to their respective system's keychain/certificate=20
store. Patch courtesy of Sebastian A. Siewior</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D""><span style=3D"max-width: 100%;" class=3D"">clamscan</span> =
and <span style=3D"max-width: 100%;" class=3D"">clamdscan</span> now =
print the scan start and end dates in the =
scan summary.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">The <span style=3D"max-width: =
100%;" class=3D"">clamonacc</span> on-access scanning daemon for Linux =
now installs to <span style=3D"max-width: 100%;" =
class=3D"">sbin</span> instead of <span style=3D"max-width: 100%;" =
class=3D"">bin</span>.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Improvements to the =
<span style=3D"max-width: 100%;" class=3D"">freshclam</span>
progress bar so the width of the text does not shift around as=20
information changes and will not spill exceed 80 characters, even on=20
very slow connections. Time is now displayed in <span style=3D"max-width: =
100%;" class=3D"">Xm XXs</span> (or <span style=3D"max-width: 100%;" =
class=3D"">Xh XXm</span>) for
values of 60 seconds or longer. Bytes display now changes units at=20
the proper 1024 B/KiB instead of 2048 B/KiB. Patch courtesy of =
Zachary=20
Murden.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Improve column alignment and line =
wrap rendering for <span style=3D"max-width: 100%;" =
class=3D"">clamdtop</span>. Also fixed an issue on Windows where =
<span style=3D"max-width: 100%;" class=3D"">clamdtop</span> would =
occasionally disconnect from <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> and fail to reconnect. Patch courtesy of =
Zachary Murden.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Improvements to the AutoIT =
parser.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Loosened the curl version =
requirements in order to build and use <span style=3D"max-width: 100%;" =
class=3D"">clamonacc</span>. You may now build ClamAV with any =
version of libcurl. However <span style=3D"max-width: 100%;" =
class=3D"">clamonacc</span>'s file
descriptor-passing (FD-passing) capability will only be available=20
with libcurl 7.40 or newer. FD-passing is ordinarily the default =
way to=20
perform scans with <span style=3D"max-width: 100%;" =
class=3D"">clamonacc</span> as it is significantly faster than =
streaming.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Added LZMA and BZip2 decompression =
routines to the bytecode signature API.</li></ul><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Disabled
embedded type recognition for specific archive and disk image=20
file types. This change reduces file type misclassification and =
improves
scan time performance by reducing duplicated file scanning. <br =
style=3D"max-width: 100%;" class=3D""></li></ul><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Use =
pkg-config to detect libpcre2-8 before resorting to pcre2-config or =
pcre-config.<br style=3D"max-width: 100%;" class=3D"">Patch courtesy of =
Michael Orlitzky.<br style=3D"max-width: 100%;" class=3D""></li></ul><h2 =
style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">Bug =
fixes</h2><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Fixed issue scanning directories =
on Windows with <span style=3D"max-width: 100%;" =
class=3D"">clamdscan.exe</span> that was introduced when mitigating =
against symlink quarantine attacks.</li></ul><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed =
behavior of <span style=3D"max-width: 100%;" class=3D"">freshclam =
--quiet</span> option. Patch courtesy of Reio Remma.</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Fixed behavior of <span style=3D"max-width: 100%;" =
class=3D"">freshclam</span>'s <span style=3D"max-width: 100%;" =
class=3D"">OnUpdateExecute</span>, <span style=3D"max-width: 100%;" =
class=3D"">OnErrorExecute</span>, and <span style=3D"max-width: =
100%;" class=3D"">OnOutdatedExecute</span> config options on Windows =
when in daemon-mode so it can handle multiple arguments. Patch =
courtesy of Zachary Murden.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed
an error in the heuristic alert mechanism that would cause a=20
single detection within an archive to alert once for every =
subsequent=20
file scanned, potentially resulting in thousands of alerts for a =
single=20
scan.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Fixed
clamd, clamav-milter, and freshclam to create PID files =
before dropping
privileges, to avoid the possibility of an unprivileged user from=20=
changing the PID file so that a service manager will kill a=20
different process. This change does make the services unable to =
clean up
the PID file on exit.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed the false =
positive (<span style=3D"max-width: 100%;" class=3D"">.fp</span>)
signature feature. In prior versions, the hash in a false positive=20=
signature would be checked only against the current layer of a file=20=
being scanned. In 0.103, every file layer is hashed, and the hashes =
for=20
each in the scan recursion list are checked. This ensures that =
<span style=3D"max-width: 100%;" class=3D"">.fp</span> signatures =
containing a hash for any layer in the scan leading up to the alert =
will negate the alert.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">As
an example, a hash for a zip containing the file which alerts would=20
not prevent the detection in prior versions. Only the hash of the=20=
embedded file would work. For some file types where the outermost =
is=20
always an archive, eg. docx files, this made <span =
style=3D"max-width: 100%;" class=3D"">.fp</span>
signatures next to useless. For certain file types where the =
scanned=20
content was a normalized version of the original content, eg. HTML, =
the=20
normalized version was never hashed and this meant that <span =
style=3D"max-width: 100%;" class=3D"">.fp</span> signatures never =
worked.</li></ul></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Fixed Trusted & Revoked =
Windows executable (PE) file signature rules (<span style=3D"max-width: =
100%;" class=3D"">.crb</span>) maximum
functionality level (FLEVEL) which had been being treated as=20
the minimum FLEVEL. These signatures enable ClamAV to trust =
executables=20
that are digitally signed by trusted publishers, or to alert on=20
executables signed with compromised signing-certificates. The =
minimum=20
and maximum FLEVELS enable or disable signatures at load time =
depending=20
on the current ClamAV version.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed a bug wherein =
you could not build ClamAV with <span style=3D"max-width: 100%;" =
class=3D"">--enable-libclamav-only</span> if curl was not installed on =
the system.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Various other bug fixes, =
improvements, and documentation improvements.</li></ul><h2 =
style=3D"font-size: 1.43em; max-width: 100%;" class=3D"">New =
Requirements</h2><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Autotools (<span style=3D"max-width:=
100%;" class=3D"">automake</span>, <span style=3D"max-width: 100%;" =
class=3D"">autoconf</span>, <span style=3D"max-width: 100%;" =
class=3D"">m4</span>, <span style=3D"max-width: 100%;" =
class=3D"">pkg-config</span>, <span style=3D"max-width: 100%;" =
class=3D"">libtool</span>)
are now required in order to build from a Git clone because the =
files=20
generated by these tools have been removed from the Git repository. =
To=20
generate theses files before you compile ClamAV, run <span =
style=3D"max-width: 100%;" class=3D"">autogen.sh</span>. Users =
building with Autotools from the release tarball should be =
unaffected.</li></ul><h2 style=3D"font-size: 1.43em; max-width: 100%;" =
class=3D"">Acknowledgments</h2><p style=3D"max-width: 100%;" =
class=3D"">The ClamAV team thanks the following individuals for their =
code submissions:</p><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Aldo Mazzeo</li><li =
style=3D"max-width: 100%;" class=3D"">=C3=81ngel</li><li =
style=3D"max-width: 100%;" class=3D"">Antonino Cangialosi</li><li =
style=3D"max-width: 100%;" class=3D"">Clement Lecigne</li><li =
style=3D"max-width: 100%;" class=3D"">Jamie Biggar</li><li =
style=3D"max-width: 100%;" class=3D"">Jan Smutny</li><li =
style=3D"max-width: 100%;" class=3D"">Jim Klimov <br style=3D"max-width: =
100%;" class=3D""></li><li style=3D"max-width: 100%;" class=3D"">John =
Schember</li><li style=3D"max-width: 100%;" class=3D"">Jonathan =
Sabbe</li><li style=3D"max-width: 100%;" class=3D"">lutianxiong</li><li =
style=3D"max-width: 100%;" class=3D"">Michael Orlitzky <br =
style=3D"max-width: 100%;" class=3D""></li><li style=3D"max-width: =
100%;" class=3D"">Reio Remma</li><li style=3D"max-width: 100%;" =
class=3D"">Sebastian A. Siewior</li><li style=3D"max-width: 100%;" =
class=3D"">Zachary Murden </li></ul><div style=3D"max-width: 100%;" =
class=3D""><br =
class=3D"webkit-block-placeholder"></div></div></div></div></blockquote></=
div></body></html>=
--Apple-Mail=_E9AE7CEA-1156-468E-AC68-1B75BF2A4B52--
--Apple-Mail=_DAD95768-D11F-445E-96A6-8BD94FCFFD59
Content-Disposition: attachment; filename="smime.p7s"
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCRYw
ggRuMIIDVqADAgECAgphEIBtAAAAAAAOMA0GCSqGSIb3DQEBBQUAMDUxFjAUBgNVBAoTDUNpc2Nv
IFN5c3RlbXMxGzAZBgNVBAMTEkNpc2NvIFJvb3QgQ0EgMjA0ODAeFw0xNDA0MDQyMDI0MThaFw0y
OTA1MTQyMDI1NDJaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBD
QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMrffhZMUxX7I1bNxrllCgSV5d5MRWeM
DMcG4KsfbV83Knvn7aOtgH8RyPOC6+6fUNnJvz2hL7s8EQc177il2VFO2bD3U6CUgCwskmWtEG+h
hmtfQAqZpVBEGpBNz+ZM+0YGjUjjB9fhrWPX1egnABW/bgeyQ7tlBi999lldmxLFLH2960SwUuHC
/B7tnVn3HZOnqzGmQkI5J9OBYsZULCaM2z0U0KiOFeoopBv+vaw8nk3W1UyvjMv/S58FbA9xgTIk
Ye0Zq77qcbRojLvI9OSLP3dTon4VnnML41d0XoPS6JPGzDSRDAKXndcHk3VUtF+DLAIXqLCQZXfZ
UuTuIncCAwEAAaOCAYcwggGDMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBSflTa0jl3VS8MK
wacpk0NRBv2JUTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwEgYDVR0T
AQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQn88gVHm6aAgkWrSugiWBf2nsvqjBDBgNVHR8EPDA6
MDigNqA0hjJodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY3JsL2NyY2EyMDQ4LmNy
bDBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3Vy
aXR5L3BraS9jZXJ0cy9jcmNhMjA0OC5jZXIwXAYDVR0gBFUwUzBRBgorBgEEAQkVARUAMEMwQQYI
KwYBBQUHAgEWNWh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy9pbmRl
eC5odG1sMA0GCSqGSIb3DQEBBQUAA4IBAQA+Tr4jGkYCjV5r24oCNAtjm+UBPCZdjHCyJOtgXuyK
hGQuG1kVo2ca4Rbj/eBNfUSaIyjS7bb3oh/nRM3tbeqGIVQorGxhvPvIZVAEQIoqi/yfbhie9cU+
paKpHACucaYXu0kyS0pYE5NMNun3Lw3ogOs4XVR5yoVSpKTiVnfTDQchTpwkMgzivqXDcS1OiDfU
8C9WaEZHRWtdUIgl9zoppPGIQa1TflcxhirW4GeH2FOrgaN1d77bIcg6R7RpJ9Xu3/f01nGNunrR
cy993c2meJQoZcOJd15C6ugHwhAxeXY6QXYgkY8KQVCCGwkpshEgbwPrC+I/Itb6P7hGq7awMIIE
oDCCA4igAwIBAgIKAYYWErs4TvKVkTANBgkqhkiG9w0BAQsFADAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwHhcNMjAwOTA4MjA0MDAzWhcNMjIwOTA4MjA1MDAz
WjCBlTEcMBoGA1UEAxMTSm9lbCBFc2xlciAoamVzbGVyKTEUMBIGA1UECxMLQ2lzY28gVXNlcnMx
EjAQBgNVBAsTCUVtcGxveWVlczETMBEGCgmSJomT8ixkARkTA2NvbTEVMBMGCgmSJomT8ixkARkT
BWNpc2NvMR8wHQYJKoZIhvcNAQkBDBBqZXNsZXJAY2lzY28uY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAtlgRHNz0SlxmINxuYgRIhGdo6KI+ceaEVMlXvu42GaUpO/Pdv3qlAV/Y
+yy1Q02lBfn18d5PF+JPy2f8K3wIQpL9X4dALwmd8GZcEF+CIvmwW3QvRtjosiOKVb5qRFuWcqIh
HKNcAEAFmeIc1ITbYupI1z0H3RVwq5fMMHEOl0A+37uelaq/Ly5ROHeWYnesARBlorXgg4XLFI3e
ElW7VARCwn1HWy+LiuBu3V91wIpKQKni17owKSvad1br+1k9zliDNmQFE+1wdZV+OCQtkTG40rcF
bxEhwtqlwSKiTGuK5oujHNP5U3oAUBeqGKeHbXeSrP0gkHo4K623v5+gbwIDAQABo4IBWDCCAVQw
DgYDVR0PAQH/BAQDAgTwMAwGA1UdEwEB/wQCMAAwegYIKwYBBQUHAQEEbjBsMDwGCCsGAQUFBzAC
hjBodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY2VjYS5jZXIwLAYIKwYB
BQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFJ+VNrSO
XdVLwwrBpymTQ1EG/YlRMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jaXNjb2NlcnRzLmNpc2Nv
LmNvbS9maWxlL2NlY2EuY3JsMBsGA1UdEQQUMBKBEGplc2xlckBjaXNjby5jb20wHQYDVR0OBBYE
FOzpIRqPuItz4nKvmlyE9WC9g2WNMB8GA1UdJQQYMBYGCisGAQQBgjcKAwwGCCsGAQUFBwMEMA0G
CSqGSIb3DQEBCwUAA4IBAQAwZUYp0Cb1QXshNnkXhC5kv4u1fu3LC442L+yCjrD5a4FeGfW8UMu1
wgJPQhVyoPw4S3E3/RuVaqp/txByfcd0jhUXSmjq8AGpMWiQg9Us4WLpoH2hn6PmEEFvKq5YLtLy
aSLHZCMIYt9zX1IFGtlT8jeKBZzr7xnzV5nUNAWJ/Dc/m25Zn0ypX/wbl9UNlHjHXl5BGiQYoLo5
jfH8y0EwyowlWBv0jOnJoyYDhm6ndS16XKWMz0wSvu4TAurnCnSQnfFZiAK6VXoAGYGRg0qyejyz
eknHW/f2VhkH8/08RqfCB2MSk+CqbXmy8lwBnrrmjuD0OFlevt/H+SNPphbSMYICajCCAmYCAQEw
OjAsMQ4wDAYDVQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGFhK7OE7y
lZEwDQYJYIZIAWUDBAIBBQCgggEBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN
AQkFMQ8XDTIwMDkxNDEzMzY1NlowLwYJKoZIhvcNAQkEMSIEIP4K6R56oKShwIHw/S58lIuZgy+P
x++SViCOaIgUWi3uMEkGCSsGAQQBgjcQBDE8MDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMT
EUNpc2NvIEVtcGxveWVlIENBAgoBhhYSuzhO8pWRMEsGCyqGSIb3DQEJEAILMTygOjAsMQ4wDAYD
VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGFhK7OE7ylZEwDQYJKoZI
hvcNAQEBBQAEggEAA3+9GWbvhOtib+7QPW3vIPT4D3zCooGOM6zJaRBCPRnwddmEKicyOc8EqxM9
+4b5FgVmvaTGc6I59nrScdj+WGwfHEl0YxuRM6EL6mOKMF5Mw+oNpXCHM0n3pafUV1DWuldkQ+mh
RQSH5FtjbIaFXm49HAvX05zGVDuMuPUNuOFZNyPqX5qYkDHXGpmW8P5oInGnymCW0Dvj9QnLCy7T
kAC1r7I6MUaP/DMTxFfZWmhe5+/hL8IbDsVOGCUk1h4CuLT320eYGBbQq/SO3gPdW9e5f/EXkZKL
emipb7C8rzZhT7NAjrSCmVu5kbiwz3pHx7g02Q1/8pmmPj1SOX22QwAAAAAAAA==
--Apple-Mail=_DAD95768-D11F-445E-96A6-8BD94FCFFD59--
--===============4991801428997552128==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce
http://www.clamav.net/contact.html#ml
--===============4991801428997552128==--