Re: sophie 3.04 libsavi 3.94

Scott Walker <[email protected]> Wed, 22 Jun 2005 14:34:30 -0700
Newsgroups gmane.comp.security.virus.vtools
Message-ID <OFEE7AFF96.26B11CE5-ON88257028.0075752B-88257028.007683EC@sophos.com>
There are two things going on here.

1) Grp options are always reported as 2 by the engine.   The only way to
confirm that a group option is set is to look at one of the options it
sets.
For example, toggle GrpArchiveUnpack and watch the ZipDecompression option.

2) However, there is still an error.  The configuration file lists the Grp
options first and the individual options next.  It also (for some reason)
lists _all_ the individual options.  Sophie reads the config file from top
to bottom, so it first sets the groups, then overwrites any options the
groups may have set by setting the individual options (thus making the
group options useless). There really is no need for all options to be
listed in the default config file.  You should only list the options you
want to change from their default.

Try commenting out ZipDecompression in the config file and toggling the
GrpArchiveUnpack option, you should see ZipDecompression change.

Scott.



[email protected] wrote on 06/22/2005 01:44:32 PM:

> Hello - I think we have uncovered a signifigant Sophie problem that may
be the
> cause of this error.
>
> I see that 3.04rc2 and 3.04 operate the same in this and so it is a long
> standing issue.
>
> Issue: sophie.savi GrpXXX settings are not respected.
>
> With testing via 'sophie -c' to show Sophie's configuration I have
> seen that the
> Grp settings are not picked up. They do not change for the default '2'.
>
> Can anyone confirm this?
>
> Dave,
>
> Quoting Ronan <[email protected]>:
>
> > hi all,
> >     As with most of you i was getting the ERROR stream corrupted blabla
> > with libsavi 3.93 and even 3.93.2(which was released at the time to try
> > and fix the sophie incompatibilty) After reading and AIUI sophos are
not
> > going to unmake the changes to libsavi for whatever reason and thats
why
> > 3.04 final was released...
> >
> > Unfortunately, now I am no longer getting any stream corrupted errors
> > but in actual fact am getting apparently no scanning now at all....
> >
> > I run the latest exim on my smtp server and have running both clamav
and
> > sophie on every message. Sophie is first preference because we have a
> > site licence for it and clamav runs second... im healthily paranoid!
> >
> > however when testing with GTUBE sophie doesnt appear to catch or indeed
> > log anything whereas clamav as expected detects and sends a
550message...
> >
> > any clues as to why its not even scanning now??
> >
> > libsavi 3.94
> > sophie 3.04 (compiled 32bit becuase of libsavi )
> > Slamd64 (slackware 10.1 64bit linux on dual opterons)
> > /lib/libc.so.6
> > GNU C Library stable release version 2.3.2, by Roland McGrath et al.
> >
> > any other info needed??
> >
> > ronan
> >
> >
> >
> > _______________________________________________
> > vtools mailing list
> > [email protected]
> > http://www.vanja.com/list/listinfo.cgi/vtools
> >
>
>
> --
> David Broome   Programmer_Analyst.FineArts.UVic.CA  /BSc /CNA /MCP
> 250.721-6307   [email protected]                FIA 221
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools


--
Scott Walker
Software Integration & Support Engineer, Sophos

Tel: 604 484 6883
Web: www.sophos.com
Sophos - protecting businesses against viruses and spam