This release provides various bugfixes, optimisations and improvements
to the scanning engine. The new features include support for ARJ and
SFX-ARJ archives, AutoIt, basic SPF parser in clamav-milter (to reduce
phishing false-positives), faster scanning and others (see ChangeLog).
To get a consistent behaviour of the anti-phishing module on all platforms,
libclamav now includes the regex library from OpenBSD.
* Bugfixes and changes since 0.91.1:
- libclamav/rtf.c: fix possible NULL dereference (bb#611)
- libclamav/ole2_extract.c: properly initialise hdr.max_block_no (bb#603)
- libclamav/htmlnorm.c: fix possible NULL dereference (bb#582),
thanks to Stefanos Stamatis
- libclamav/htmlnorm.c: fix call to tolower() (bb#580)
- libclamav/filetypes.c: some embedded PEs were not being detected
- clamav-milter: Fix compilation error on NetBSD2.0
- clamav-milter: Black-hole-mode no longer needs to be run as root
- libclamav/pdf.c: Bug 618, --block-max not always honoured
- libclamav/phishcheck.c, regex_list.c, phish_whitelist.c: make debug
output look better (patch from Sven)
- libclamav/phishcheck.c: Don't report phishing on broken urls containing
'>' in the hostname. (bb #619)
- libclamav, sigtool: add support for PUA databases (.hdu, .mdu, .ndu),
requested by Christoph
- clamscan: add --detect-pua
- clamd, clamd.conf: add DetectPUA
- freshclam/mirman.c: properly handle mirror access times (bb#606, only
outdated installations - three versions behind the latest one were
affected by this problem),
Reported by David F. Skoll <dfs*roaringpenguin.com>
- clamav-milter: Bug 614
- libclamav/pdf.c: Bug 608
- clamav-milter: SPF checking no longer experimental
- libclamav/phishcheck.c: workaround Solaris problem with regexec() [bb #598
]
- libclamav/matcher-ac.c: fix matching of patterns with prefixes and some
other issues spotted by Glen <daineng*gmail.com>
- clamav-milter/clamav-milter.c: Better use of res_init()
- clamav-milter/clamav-milter.c: HP-UX doesn't have EX_CONFIG, reported
by clam * ministry.se
- libclamav/others.c: bump f-level
- libclamav/unrar/unrarvm.c: fix another occurrence of bb#555, thanks to
Ludwig Nussel <ludwig.nussel*suse.de>
- sigtool/sigtool.c: increase MAX_DEL_LOOKAHEAD, requested by Sven
- libclamav/scanner.c: don't search for embedded PEs in zip files larger
than 1 MB (bb#573)
- clamav-milter: Fix memory leak when load balancing
- clamav-milter: Chroot handling no longer marked as experimental
- libclamav/nsis: fix macro collision on AIX - bb#570
- libclamav/phishcheck.c: fix (null) FOUND
- libclamav: rename x86 macroes due to collisions on HPUX
- libclamav: Fix warnings on HP-UX
ClamAV 0.91 is the first release to enable the anti-phishing technology
in default builds. This technology combines heuristics with special
signatures and provides effective protection against phishing threats.
Other important changes and add-ons in this version include:
- unpacker for NSIS (Nullsoft Scriptable Install System) self-extracting
archives
- unpacker for ASPack 2.12
- new implementation of the Aho-Corasick pattern matcher providing
better detection for wildcard enabled signatures
- support for nibble matching and floating offsets
- improved handling of .mdb files (fixes long startup times)
- extraction of PE files embedded into other executables
- better handling of PE & UPX
- removed dependency on libcurl (improves stability)
- libclamav.dll available under Windows
- IPv6 support in clamav-milter
- many other improvements and bugfixes
the owner of all installed files is a non-root user. This change
affects most packages that require special users or groups by making
them use the specified unprivileged user and group instead.
(1) Add two new variables PKG_GROUPS_VARS and PKG_USERS_VARS to
unprivileged.mk. These two variables are lists of other bmake
variables that define package-specific users and groups. Packages
that have user-settable variables for users and groups, e.g. apache
and APACHE_{USER,GROUP}, courier-mta and COURIER_{USER,GROUP},
etc., should list these variables in PKG_USERS_VARS and PKG_GROUPS_VARS
so that unprivileged.mk can know to set them to ${UNPRIVILEGED_USER}
and ${UNPRIVILEGED_GROUP}.
(2) Modify packages to use PKG_GROUPS_VARS and PKG_USERS_VARS.
For some reason, the script creates the pid file itself, instead
of using '-p' option to freshclamd. sig_stop=KILL seems unnecessary,
too.
Bump PKGREVISION.
The 0.9x series introduces lots of improvements in terms of detection
rate and performance, like support for many new packers and decryptors,
RAR3 and SIS archives, and a new phishing signatures format that proves
to be very effective.
- freshclam: apply timeout patch from Everton da Silva Marques
<everton*lab.ipaccess.diveo.net.br> (new options: ConnectTimeout and
ReceiveTimeout)
- clamd: change stack size at the right place (closes bug#103)
Patch from Jonathan Chen <jon+clamav*spock.org>
- libclamav/petite.c: sanity check the number of rebuilt sections (speeds
up handling of malformed files)
(I tried to contact the MAINTAINER but got no reply. I'm using this in our
production systems so this should work just fine.)
* Bugfixes:
- libclamav/rebuildpe.c: fix possible heap overflow [IDEF1597]
- libclamav/chmunpack.c: fix possible crash [IDEF1736]
- freshclam/manager.c: "Cache-Control: no-cache" is now disabled by default.
If you're behind a broken proxy you can recompile freshclam with
--enable-no-cache.
Changes:
- libclamav/upx.c: fix possible heap overflow
See http://www.clamav.net/security/0.88.4.html for details.
- libclamav/tnef.c: handle trailing newline at the end of winmail.dat,
bug reported by Menno Smits <menno*netboxblue.com>
- freshclam/manager.c: fix possible infinite loop when read() fails
in get_database(), spotted by Everton da Silva Marques
<everton*lab.ipaccess.diveo.net.br>
and add a new helper target and script, "show-buildlink3", that outputs
a listing of the buildlink3.mk files included as well as the depth at
which they are included.
For example, "make show-buildlink3" in fonts/Xft2 displays:
zlib
fontconfig
iconv
zlib
freetype2
expat
freetype2
Xrender
renderproto
changes since 0.88:
* Bugfixes:
- libclamav/matcher.c: properly handle partial reads in cli_scandesc()
- libclamav/mbox.c: sync with CVS, fixes detection of Worm.Bagle.CT
- freshclam: fix support for LocalIPAddress
Patch by Anton Yuzhaninov <citrin*citrin.ru>
- docs/man: multiple manpage typo fixes
Patch by A. Costa <agcosta*gis.net>)
- shared/output.c: properly handle return value of vsnprintf
Thanks to Anton Yuzhaninov <citrin*rambler-co.ru>
- libclamav/htmlnorm.c: fix typo spotted by Gianluigi Tiesi
<sherpya*netfarm.it>
- sigtool/sigtool.c: fix possible crash in build(), thanks to Sven
- clamd/session.c: remove static timeout (5s) for SESSION
Pointed out by Joseph Benden <joe*thrallingpenguin.com>
- libclamav/pe.c: fix possible integer overflow reported by Damian Put
Note: only exploitable if file size limit (ArchiveMaxFileSize) disabled
- libclamav/scanners.c: properly report archive unpacking errors
Problem spotted by David F. Skoll <dfs*roaringpenguin.com>
- libclamav/others.c: fix possible crash in cli_bitset_test()
Reported by David Luyer <david_luyer*pacific.net.au>
- libclamav/zziplib: fix possible crash on FreeBSD
Reported by Robert Rebbun <robert*desertsurf.com>
- clamav-milter: fall back if sendfile() fails
RECOMMENDED is removed. It becomes ABI_DEPENDS.
BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo.
BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo.
BUILDLINK_DEPENDS does not change.
IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS
which defaults to "yes".
Added to obsolete.mk checking for IGNORE_RECOMMENDED.
I did not manually go through and fix any aesthetic tab/spacing issues.
I have tested the above patch on DragonFly building and packaging
subversion and pkglint and their many dependencies.
I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I
have used IGNORE_RECOMMENDED for a long time). I have been an active user
of IGNORE_RECOMMENDED since it was available.
As suggested, I removed the documentation sentences suggesting bumping for
"security" issues.
As discussed on tech-pkg.
I will commit to revbump, pkglint, pkg_install, createbuildlink separately.
Note that if you use wip, it will fail! I will commit to pkgsrc-wip
later (within day).
INSTALL/DEINSTALL script creation within pkgsrc.
If an INSTALL or DEINSTALL script is found in the package directory,
it is automatically used as a template for the pkginstall-generated
scripts. If instead, they should be used simply as the full scripts,
then the package Makefile should set INSTALL_SRC or DEINSTALL_SRC
explicitly, e.g.:
INSTALL_SRC= ${PKGDIR}/INSTALL
DEINSTALL_SRC= # emtpy
As part of the restructuring of the pkginstall framework internals,
we now *always* generate temporary INSTALL or DEINSTALL scripts. By
comparing these temporary scripts with minimal INSTALL/DEINSTALL
scripts formed from only the base templates, we determine whether or
not the INSTALL/DEINSTALL scripts are actually needed by the package
(see the generate-install-scripts target in bsd.pkginstall.mk).
In addition, more variables in the framework have been made private.
The *_EXTRA_TMPL variables have been renamed to *_TEMPLATE, which are
more sensible names given the very few exported variables in this
framework. The only public variables relating to the templates are:
INSTALL_SRC INSTALL_TEMPLATE
DEINSTALL_SRC DEINSTALL_TEMPLATE
HEADER_TEMPLATE
The packages in pkgsrc have been modified to reflect the changes in
the pkginstall framework.
A possible heap overflow in the UPX code has been fixed. General improvements
include better zip and mail processing, and support for a self-protection mode.
The security of the UPX, FSG and Petite modules has been improved, too.
changes since 0.87:
* Bugfixes:
- libclamav/petite.c: fix boundary checks (acab)
- libclamav/mbox.c: scan attachments that have no filename (njh)
- libclamav/fsg.c: fix buffer size calculation in unfsg_133
Reported by Zero Day Initiative (ZDI-CAN-004)
- libclamav/tnef.c: fix possible infinite loop
Reported by iDEFENSE (IDEF1169).
- libclamav/mspack/cabd.c: fix possible infinite loop in cabd_find
(tk)
Reported by iDEFENSE (IDEF1180).
- clamd/others.c: fix compilation error on Cobalt Qube 1 (tk)
- clamd: properly handle ReadTimeout in SESSION (tk)
Bug reported by Kamil Kaczkowski <kamil*kamil.eisp.pl>
- libclamav/others.c,h: Add generic bitset implementation (trog)
- libclamav/ole2_extract.c: Make sure the property tree doesn't
loop (trog)
Fixes CAN-2005-3239. Installations with default settings were
not affected by this bug.
This version fixes vulnerabilities in handling of UPX and FSG compressed
executables. Support for PE files, Zip and Cabinet archives has been improved
and other small bugfixes have been made. The new option "--on-outdated-execute"
allows freshclam to run a command when system reports a new engine version.
backslashes anymore. A single backslash is enough. Changed the
definition in all affected packages. For those that are not caught, an
additional check is placed into bsd.pkginstall.mk.
changes since 0.86.1:
V 0.86.2
* Fixes backported from CVS:
- configure.in: disable support for URLs downloading with libcurl
(--with-libcurl) by default (tk)
- libclamav/others.c: cli_rmdirs: fix possible infinite loop (tk)
Patch by Mark Pizzolato <clamav-devel*subscriptions.pizzolato.net>
- libclamav/mspack: Some cab archives were not properly decompressed (tk)
Problem reported by Diego d'Ambra <diego*clamav.net>
- libclamav/pe.c: cli_peheader: Sync entry point calculation with
cli_scanpe (tk)
Problem reported by Christoph Cordes <ccordes*clamav.net>
- configure.in: fix compilation error when curl is installed in
a non-standard location (tk)
Reported by Serge van den Boom <svdb*stack.nl>
- configure.in: Add support for DragonFly (tk)
Thanks to Joerg Sonnenberger <joerg*britannica.bec.de>
- clamscan/clamscan.c: Verify arguments passed to --max-dir-recursion and
--max-ratio (tk)
Problem reported by Jo Mills <Jonathan.Mills*frequentis.com>
- libclamav/fsg.c: Fix possible integer overflow (acab)
Reported by Alex Wheeler.
- libclamav/mbox.c: Fix name clash with glibc library (njh)
Reported by Brian Bruns <bruns at 2mbit.com>
- libclamav/others.c: Check for 0 byte allocations in cli_(m|c|re)alloc (tk)
- libclamav/chmunpack.c: Fix possible malloc overflow (trog)
Reported by Alex Wheeler.
- libclamav/tnef.c: Fix possible crash if the length field is 0 or negative
in headers (njh)
Reported by Alex Wheeler (alexbling at gmail.com)
- clamav-milter: Honour LogClean. Only syslog once when storing email in
quarantine (reported by Panagiotis Christias, christias at gmail.com).
Log database reloads to the LogFile (njh)
- clamav-milter: Changed the default child_timeout to 5 minutes. Keep a
copy of the trie root in privdata. Removed trylock/unlock code in
clamfi_abort (njh)
(as with NetBSD 2, for instance), but pkgsrc sendmail 8.13 is installed,
then clamav will attempt to use the 8.13 milter API, and fail linking.
(It probably should use an autoconf symbol test instead.)
This change forces an API at least new enough to match the latest version
offered via pkgsrc; and since libmilter is a static library, it still
ends up with no runtime DEPENDS.
No PKGREVISION bump required, as milter is a non-default option.
