Wrong behaviour of Kaspersky aveclient routine

I run amavisd-new-20030616.p7 on FreeBSD 5.2 using postfix 2.0.18 and
AVP 5.0.2.0 (FreeBSD native version)

I found out that if aveclient checks multiple files in one directory
(=more than one attachment), it always shows the exit code 0, if the
last file (alphabetically) was not infected, regardless of the other
files. It says so in the man page of aveclient:

> When launched with the -s option, aveclient returns one of the  follow-
> ing  codes (if several files to be scanned are indicated in the command
> line, the return code corresponds to the results of scanning  the  last
> file):
> 0      no viruses have been detected.

  This of course means that viruses get through, as you can see in this
piece of debug code:

> Feb 11 19:59:51 mail.example.com amavisd[74351]: (74351-02) Using
> KasperskyLab AVP - aveclient: /usr/local/share/kav/bin/aveclient -p
> /var/run/aveserver -s
> /var/amavis/amavis-20040211T195307-74351/parts/part-00001
> /var/amavis/amavis-20040211T195307-74351/parts/part-00002
> /var/amavis/amavis-20040211T195307-74351/parts/part-00003 Feb 11
> 19:59:51 mail.example.com amavisd[74351]: (74351-02) run_command:
> [74423] /usr/local/share/kav/bin/aveclient -p /var/run/aveserver -s
> /var/amavis/amavis-20040211T195307-74351/parts/part-00001
> /var/amavis/amavis-20040211T195307-74351/parts/part-00002
> /var/amavis/amavis-20040211T195307-74351/parts/part-00003 </dev/null
> 2>&1 Feb 11 19:59:51 mail.example.com amavisd[74351]: (74351-02)
> run_av: /usr/local/share/kav/bin/aveclient status=0 (0
> ),/var/amavis/amavis-20040211T195307-74351/parts/part-00001
> OK\n/var/amavis/amavis-20040211T195307-74351/parts/part-00002
> INFECTED\nLINFECTED
> EICAR-Test-File\n/var/amavis/amavis-20040211T195307-74351/parts/part-00003
> OK Feb 11 19:59:51 mail.example.com amavisd[74351]: (74351-02)
> run_av: clean


Part 00003 is OK, so amavisd thinks it's save!

To change this, I changed the config file from this:

> #  ['KasperskyLab AVP - aveclient', ['/usr/local/share/kav/bin/aveclient','aveclient'],
> #    '-p /var/run/aveserver -s {}/*', [0,3], [2,4,6,8],
> #    qr/LINFECTED (.+)/,
> # ],

into this:

>   ['KasperskyLab AVP - aveclient', ['/usr/local/share/kav/bin/aveclient','aveclient'],
>     '-p /var/run/aveserver -s {}/*', [0], 'INFECTED',
>     qr/LINFECTED (.+)/,
>   ],

This should also apply to the Linux version of AVP.
I hope I could be helpful...

Andreas





-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/