ClamAV Forced Upgrade Breaks Email Servers

An anonymous reader writes "A couple of weeks ago Sourcefire announced end-of-life for version 0.94 of its free ClamAV antivirus package (and in fact has been talking about it for six months). The method that Sourcefire chose to retire 0.94 was to shut down the server that provided its service. Those who had failed to upgrade are scrambling now. Many systems have no choice but to disable virus checking in order to continue to process email. I am very glad I saw the announcement last week!"

Comments

Alternative

[InsertWittyNameHere]

The alternative was them not doing anything and then months later we see a story about how "ClamAV silently stops support. Virus outbreaks ensue."

Re:Alternative

[Anonymous Coward]

It's kind of an inflammatory article:

Rather than simply phase this geriatric version out (it was at least one year old, revised to versions .95 and .96 since release, and announcements about the need to upgrade had been made for six months) the development team put to halt instances of V0.94 in production

So, it's a year and two versions out of date AND they'd been saying for 6 months to move off it.. Yet still it's their fault for shutting down the server!? I'm sorry, but how much support do you want for something that's free?

Re:Alternative

[compro01]

It's quite a bit more extreme than just shutting down one of their servers. They issued a final "signature" update that literally caused each installation of that version to stop functioning.

From the announcement :

Starting from 15 April 2010 our CVD will contain a special signature which disables all clamd installations older than 0.95 - that is to say older than 1 year.

Re:Alternative

[HarrySquatter]

Would you trust an email server that is running a virus scanner that is more than a year out of date?

Re:Alternative

[ccandreva]

It's more complicated than that.

Older versions of clamd were going to crash on signatures that newer versions would accept, and they have been prevented for at least 6 months from using that type of signature. They have posted since then for people to upgrade.

When they did was publish this type of signature (has to do with length, greater than about 900bytes), where the signature itself is an error message, so when the program dumped the signature the error would be displayed.

That's all, not a kill switch as such, but using a known bug to deliver a message, rather than have it just bomb out with a hex dump when they tried to use a larger signature.

Re:Alternative

[Anonymous Coward]

Yep, and when did they post that? 6 months ago. McAfee recently gave us 2 months notice at work that pre 8.x client would no longer be supported - not a problem as 7.1 was eol ages ago - since then there's been 8.0, 8.5 and currently 8.7 which we're moving to.

No big deal for those who properly manage their systems.

Re:Alternative

[geekmansworld]

When you make assumptions, you're an ass.

I don't watch TV at work. I'm busy because I'm the only IT guy in our organization, and I do everything, on top of regular office work, on a shoestring budget.

So while you're sitting in your office preparing the budget to show your boss how many tens of thousands of dollars the new M$ Exchange system is going to cost, maybe think about how lucky you are to be able to do what you love to do full time, with a budget, and proper support staff.

Re:Alternative

[b0bby]

Honestly, for things like this that I don't have the time to do right I prefer to let someone else do them. In this case, why not route your mail through Postini or another service? I'm pretty sure that I can't hope to do a better job filtering than Google...

Re:Alternative

[Fiznarp]

I got hit by the shutdown too, however I'm not upset. If I was paying for it I would have been angry at the vendor for not notifying me. But it's a FREE antivirus service. The folks that publish ClamAV updates aren't under any obligation to keep my systems up and running. If my systems were that important, I'd pay for something with an SLA.

Re:Alternative

[CoolQ]

Uh, it HAS been filling your log files with warnings about upgrading for months, if not years. It's pretty f'ing explicit:

LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***

--Quentin

Re:Alternative

[Anonymous Coward]

Postini is cheap and works.

Re:Alternative

[Hylandr]

I agree with geekmansworld.

And while someone below complained "And you didn't, and now are going to complain when shit doesn't work?"

Damn right. IT techs aren't the gods our ego's lead us on to believe, and keeping up with a tremendous workload is tough enough without having to predict what software vendor / FOSS app is going to sabotage the works.

In a production environment all changes are tested before deployment with rollback plans at the ready. Any software that has the ability to throw a kill switch into a production environment ( Bug or not ) makes the blacklist for any consideration.

So long ClamAV

- Dan.

Re:Alternative

[Anonymous Coward]

You're a retard. So ClamAV fixed a bug that would have caused it to crash, warned you six months in advance of outdated signatures, and you have the gall to shift your irresponsibility onto ClamAV maintainers?

I wouldn't even suspect a Windows administrator of such negligence. I hope you enjoy OSX. I hear it's made for people like you.

Re:Alternative

[Jiro]

It may not have occurred to you that some of us only do IT for out organizations part time, and visiting the blogs of every single open-source component on our servers is not always practical.

The issue has nothing to do with your servers, really; it has to do with their servers. If you're using a free service on someone else's servers, you really can't be surprised when that service suddenly stops functioning. It's not your equipment.

And I would wager that while visiting the blogs of everything on your servers isn't practical, visiting the blogs of (or subscribing to a mailing list, or other monitoring of) everything that's on your servers but uses someone else's servers is practical

Re:Alternative

[radtea]

This such a perfect example of a loser with attitude that I deserves comment. Look at the breakdown of points, hitting every checkbox:

1) Implies that anyone who criticizes his failure to do this job is ignorant of his difficult working conditions.

2) Implies that doing is job is an unreasonable burden that no one could expect, despite other people managing it, sometimes under conditions that he has no idea how difficult they are.

3) Implies that he did absolutely nothing wrong: his configuration was not an issue--that it was right and reasonable to have his servers configured to crash on failure of this "low priority" component, like a mechanic telling you it's right and reasonable for the wheels to fall off if the radio stops working, because the radio operating correctly is a low priority.

4) Implies that he's a hero for fixing a problem he caused by his neglect and incompetence. Despite his low pay he's on call all the time, and worked for hours fixing things brilliantly and heroically, despite having mis-configured a low-priority component as a critical system whose incidental failure could crash the whole works.

5) Blames someone else who did thier job well, and for free. Accuses a supplier of a free service who have been filling his logs with messages for six months of not filling his logs with messages for six months, and then accuses them of deliberately crashing his incompetently configured servers.

6) Re-iterates how over-worked he is and how much he has to do.

7) Proclaims he's going to look for another free service to blame his next failure on Real Soon Now.

Classic, classic whiner. Your job may suck, man, and that may not be all your fault, but if you don't fix the attitude you'll be stuck in the suck for a long, long time...

Re:Alternative

[Pharmboy]

You could do what we did: outsource email for $15 a month (up to 200 clients) to yahoo.com. It works, it uses a familiar interface, it has AV, it has some spam filtering, it uses a web browser so it is usable on all platforms. It isn't perfect, but if email is such a mission critical element, then they need to put more resources into it. Likely, you needs are not that much different than ours (15 people who use email to talk to customers daily). We have been on it for 5 years now, and it is the best 15 bucks a month we have ever spent.

Re:Alternative

[cstdenis]

The "DON'T PANIC!" was obviously the wrong message to display for something that was going to break your mail server.

Re:Alternative

[Anonymous Coward]

It may not have occurred to you that some of us only do IT for out organizations part time, and visiting the blogs of every single open-source component on our servers is not always practical.

Why not just keep your software relatively up to date? It's really not that difficult. If you're using Linux and you're distribution's ClamAV package it's done automatically. If you're running Windows and ClamWin it will notify you when new releases are available.

Re:Alternative

[syousef]

Would you trust an email server that is running a virus scanner that is more than a year out of date?

Would you trust a company who would remotely shut off your anti-virus?

Re:Alternative

[uniquegeek]

Regardless, it's moot after the fact, isn't it? There's also no guarantee a company you trust wouldn't do something unexpected, either.

Re:Alternative

[jim_v2000]

Yes. Especially when there was six months warning that it was going to happen.

Also, I'd rather it stop working then keep working and not get definition updates.

Re:Alternative

[dissy]

ClamAV could have simply become impotent and started filling my log files with warnings about upgrading.

Had to stop reading your fake rant right there.

You clearly do not use clamav, so are not affected by this. You need to hush.

If you installed it anywhere, you would see it DID become impotent and started filling your log files with warnings to upgrade, for half a year.

Your statements do not reflect reality, so it is impossible for anyone to take you seriously.

Re:Alternative

[DiegoBravo]

It's not my antivirus.

Re:Alternative

[DrYak]

technically, they didn't shut down the old daemon per se, they started using new signatures for which .94 wasn't compatible anymore.

in other words:

would you trust an anti-virus that doesn't move to modern detection techniques, because a couple of idiots refuse to upgrade despite 2 years of for-warning

Re:Alternative

[Bert64]

A sales rep won't always sell you the best product for the job...
They will sell you whichever gives them the most commission. And as for support, most of them employ a bunch of totally clueless morons who know little more than how to follow the quick start guide that comes with the products they install.

Re:Alternative

[Bert64]

It was telling you not to panic for a YEAR... If you'd updated it when it first started notifying you then it never would have broken anything.

Re:Alternative

[syousef]

Read the story. They didn't just disable new updates. They disabled the Antivirus engine altogether.

Re:Alternative

[SunFireSpaz]

Any reason that you did not do what the organization requested?

From http://www.clamav.net/lang/en/download/sources/ it states:

Please subscribe to our freshmeat project page or clamav-announce to receive notifications of new stable releases and RCs.

They sent out a couple of notices about what was going to happen.

I will give the poster a little leeway in that this notice is only on the source download page and not the parent download page or the other distribution download pages.

Re:Alternative

[SunFireSpaz]

Join their announce mailing list at http://lists.clamav.net/mailman/listinfo/clamav-announce and you will be notified about these type of things.

Re:Alternative

[SunFireSpaz]

I mentioned this in a reply above....

Is there reason that you were subscribed to their announce mailing list? If so, you would have know about this issue months ago. Plenty of time to upgrade/test/deploy even in the most restrictive environments.

See http://lists.clamav.net/mailman/listinfo/clamav-announce for the archives and subscribing information.

Re:Alternative

[Cramer]

It's not the scanner you have to worry about. It's the signature updates that matter. Do you download a new copy of Norton or McAfee or AVG every year? Most people don't. Companies certainly don't.

Re:Alternative

[Cramer]

This assumes people READ those log files.

Re:Alternative

[amorsen]

Yes and everyone ignores those, because they appear even for fully updated installations. E.g. Fedora 13 which isn't even out yet is still on ClamAV 0.95.3.

Re:Alternative

[pe1chl]

The problem is that it logs this silly message for every minor version update, so people have become accustomed to it and learned to ignore it.

Re:Alternative

[Bert64]

I have Clam installed on a mailserver, i update it whenever an update becomes available because it's a fairly critical piece of code (it directly interacts with malicious code received via email and performs some fairly complex analysis on it, plenty of scope for exploitation)...

Re:Alternative

[petermgreen]

An antivrus update pretty much by definition has the ability to do some serious damage.

Not that I think this was a good thing (far from it) but if you are using antivirus in an environment that important you readlly should be testing all your updates.

So you had 6 months to upgrade

[gparent]

And you didn't, and now are going to complain when shit doesn't work? Go fuck yourself.

Re:So you had 6 months to upgrade

[Anonymous Coward]

go fuck yourself

uh. this is slashdot. for most of us, that is a redundant instruction.

what would have been far more offensive is

go fuck someone else

as we all know that's not possible for most of us. ...you insensitive clod.

Re:So you had 6 months to upgrade

[X0563511]

Don't know about gparent, but I'm effected by endless clueless customers whining that their email server broke.

Re:So you had 6 months to upgrade

[johnshirley]

Kinda my attitude, too. Had this affect a bunch of servers yesterday. Started researching, found the cause, and solved the problem in 30 minutes on 35 or so servers. Totally my own damned fault for not staying upgraded. Worst impact was that messages were delayed on a few mail server for half an hour and uploads to a handful of webservers threw errors because of the way I scan them. Users tried again. Problem solved.

Re:So you had 6 months to upgrade

[poena.dare]

Oh this is awesome! I'll be able to bill many more hours to fix this one once the emails start rolling in... hey, WTFs wrong with my mail server?

Re:So you had 6 months to upgrade

[GungaDan]

I only got hit on one server. Lucky me. Aptitude safe-upgrades for me every night, but I had been lazy about reviewing the logs. Otherwise I might have noticed the "automatically held back" messages about clamav over the past couple of weeks... oops.

Re:So you had 6 months to upgrade

[The Moof]

So you had 6 months to upgrade and you didn't, and now are going to complain when shit doesn't work?

No, but they'll complain (rightfully so) when the developers issue a "killswitch" command causing the software to quit working. So it's not like the servers disappear and stuff broke from obsolescence, they issued a command to the servers and had the software shut itself down (documented here).

Re:So you had 6 months to upgrade

[gparent]

I'm angry at all the people who will most likely whine about this even though it's their fault. No, I was not affected.

Re:So you had 6 months to upgrade

[Culture20]

I'm effected by endless clueless customers whining that their email server broke.

While such an occurrence would prompt me into action, I doubt it would prompt me into existence. ;)

Re:So you had 6 months to upgrade

[gggggggg]

Not exactly. I personally didn't update because Debian Stable didn't. Mail service on Debian Stable servers using clamav broke early this morning. There's "stable" for you...

Re:So you had 6 months to upgrade

[gparent]

After 6 months of warning.

Re:So you had 6 months to upgrade

[geekmansworld]

Let me say one last thing to those of you telling the rest of us what lousy sysadmins we are.

This is no different than responding to some poor schmuck who had his system broken into and ransacked by mafia hackers by shaking your head and saying: "Well, it's his fault for not being proactive enough about security."

Maintaining systems is not an easy task, it's a multi-level approach combining security, usability, upgrades, and your budget. The question with security is always, "How paranoid am I going to be?" And you then have to balance usability, your time and the budget against how unlikely it will be that someone can figure out how (and be bothered) to crack your RSA certificate.

Likewise, I have to balance my time and budget against how important I feel certain components are. For an organization that has workstation AV and a lot of technology expansion demands this year, monitoring ClamAV was not at the top of my priority list.

So yeah, you can tell me this is my fault, but I doubt very much the last time someone told you that their car got stolen you simply turned up your nose at them and said it was their own fault and that they were an idiot for not buying a better alarm system.

Re:So you had 6 months to upgrade

[gparent]

I really wish thieves would let you know half a year in advance when they'd steal your car.

Re:So you had 6 months to upgrade

[geekmansworld]

I accept e-mail, phonecalls, text messages, and Facebook.

Updating your support site does not count as "let me know".

Re:So you had 6 months to upgrade

[gparent]

http://lists.clamav.net/mailman/listinfo/clamav-announce

Re:So you had 6 months to upgrade

[tsm_sf]

If you can't commit to supporting software for at least 3 years, you have no right marketing to businesses.

I hear this all the time from people who never actually had to use their Microsoft support.

Re:So you had 6 months to upgrade

[NuShrike]

RTFA. Of course you didn't and so you didn't figure out this is a free product free to do what it needs because NOBODY paid for the support. It's lusers like you that hold things back by whining about free support.

Re:So you had 6 months to upgrade

[idontgno]

You're absolutely right. To use a car analogy:

stuff not working WELL because of negligence on my part

That's letting your drive off a bluff into the river because the bridge was condemned and about to collapse

a software provider deliberately breaking software, and my entire mail system, to punish me for not having the latest version

That's putting up construction barriers and stopping your progress across the river to save you from your own inattention to the "BRIDGE CONDEMNED" signs that have been up for the last six months.

Anyone wanna try phrasing this as a pizza analogy?

Re:So you had 6 months to upgrade

[david_thornley]

That's right. You should sue them for triple your money back!

Re:So you had 6 months to upgrade

[masdog]

I had modded this overrated, but this really deserves a reply.

You're in the wrong place if you expect sympathy. There are a lot of other sysadmins here. There are a lot who wear all of the hats. You're not alone.

You had a poorly designed or poorly implemented mail system. That isn't clamAV's fault. It's not their fault that you didn't upgrade or check your system logs. This is no different than forgetting to pay the maintenance bill on a commercial mail gateway or hosted solution. Would you blame Symantec, McAfee, Microsoft, or CA if you didn't pay the bill and your mail stopped flowing?

The fact that you didn't follow a blog or mailing list about a critical piece of your infrastructure says a lot about you as a sysadmin. They're even on Facebook and Twitter. If you can't take the time to keep an eye on your mail gateway or antivirus product, what else aren't you keeping up on. Think about that for a few minutes, set up a Google reader account, and then start subscribing to blogs. If you have a smartphone, add Google reader to your RSS Reader. It makes good bathroom reading.

Re:So you had 6 months to upgrade

[syousef]

And you didn't, and now are going to complain when shit doesn't work?

Go fuck yourself.

So instead of leaving me with my working but out of date anti-virus you decide to remotely disable it? Go fuck yourself.

Re:So you had 6 months to upgrade

[gparent]

And you didn't, and now are going to complain when shit doesn't work?

Go fuck yourself.

So instead of leaving me with my working but out of date anti-virus you decide to remotely disable it? Go fuck yourself.

How long would it have taken you to notice your anti-virus was outdated if you can't notice 6 months of warning?

Re:So you had 6 months to upgrade

[SunFireSpaz]

And they also sent out 4 separate e-mails to their announce mailing list over the last six months with the most recent last week. See the archives at http://lists.clamav.net/mailman/listinfo/clamav-announce.

Re:So you had 6 months to upgrade

[Anonymous Coward]

I'd also like to add that there is no excuse to ignore log from any production sistem. It's extremely quick and easy to filter out all the "normal operational" messages, so that everything that goes in the log is a problem to be dealt immediately or a new rule for the normal messages filter.

Re:So you had 6 months to upgrade

[mcmonkey]

Read my F comment. Of course you didn't and so you didn't figure out my strongest criticism was the lusers who try to run a business on software that is not ready for prime time.

Re:So you had 6 months to upgrade

[supssa]

You are useless at your job, I hope your employer knows this and pays you accordingly.

Got This Bounce This Morning

[WrongSizeGlass]

Diagnostic-Code: smtp;
451-4.5.0 Error in processing, id=02792-02, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x83d7540) Too many retries to talk to /var/spool/amavisd/clamd.sock (Can't connect to UNIX socket /var/spool/amavisd/clamd.sock: No such file or directory) at (eval 55) line 310.

ClamAV-clamscan av-scanner FAILED: /usr/bin/clamscan unexpected exit 50, output="LibClamAV Error: cli_hex2str(): Malformed hexstring: This ClamAV version has reached End of Life! Please upgrade to version 0.95 or later.

At least their error messages are descriptive and informative.

Re:Got This Bounce This Morning

[Slipped_Disk]

At least their error messages are descriptive and informative.

Seriously -- I got a bunch of qmail deferrals & the bounce/deferral messages were all utter shit ("451 qq error").
This guy wins 100 internets for having a FUCKING USEFUL BOUNCE MESSAGE -- I want to buy him a case of his preferred alcoholic beverage.

Re:Got This Bounce This Morning

[thsths]

> At least their error messages are descriptive and informative.

Indeed. Accurate error messages are something that Microsoft never quite achieved, and Apple never even tried. "It does not work, please have a look at our website www.fuckandall.com for possible causes" - I hate that!

Re:Got This Bounce This Morning

[pclminion]

Indeed. Accurate error messages are something that Microsoft never quite achieved, and Apple never even tried. "It does not work, please have a look at our website www.fuckandall.com for possible causes" - I hate that!

Well, duh. You can either A) Provide a meaningful error message that helps the user solve the problem, or B) Provide a link to a web site that, ultimately, contains the information needed to solve the problem, but in the meantime you get to serve up 50 or so advertising impressions. I wonder which method the corporations will choose... the one that makes money or the one that doesn't?

[clamav-announce]

[0racle]

It exists for a reason.

Re:[clamav-announce]

[1s44c]

It exists for a reason.

I'm going to subscribe to it now. I don't want to go though that again.

But I can't subscribe to the announce list for every free software product I use, I'd do nothing else but read these lists.

Re:[clamav-announce]

[entrigant]

announce lists are intentionally very low traffic. I'm subscribed to over 50, and I rarely receive more than 4 or 5 mails a week at most.

Re:[clamav-announce]

[0racle]

This is what e-mail rules are for and to echo what the other poster said, they do not generate much traffic. While there is probably very little reason to subscribe to lists for absolutely every piece of software you run, you should probably subscribe to the announce lists for the major products you use.

Re:[clamav-announce]

[dissy]

But I can't subscribe to the announce list for every free software product I use, I'd do nothing else but read these lists.

Wait, you'd spend 100% of your time by reading 2-3 emails a month?
No wonder your email servers are suffering ;}

Kidding aside, -announce is not like -user or -help lists.

For me personally in gmail all lists except announcement ones are auto sorted to labels and marked read. It's mainly to search through for reference when I need it.

Announcement lists however go right to my inbox. I'm on roughly 20 announce lists and get maybe at most 10 emails a month from them, but usually much less.

Just make sure the list you are subscribing to is the one only their staff can post to, and only contains important announcement information.
You definitely don't want to accidentally get the main user group list and try to keep up on everything if you are on more than about 3 lists at any given time. That would be hell ;}

Re:[clamav-announce]

[amorsen]

But I can't subscribe to the announce list for every free software product I use, I'd do nothing else but read these lists.

I can recommend Gmane for that kind of thing. If you stick to the announce lists it shouldn't be a problem.

Also, if you get your free software as a complete bundle (i.e. as a Linux distribution or Cygwin or similar), all you have to do is keep up with that.

this is common

[digitalsushi]

This is what we get when we're all our own "netadmins". I'm one of them. I don't follow security lists. I don't upgrade my products. Why not? Because I'm not really a netadmin. I just have a little server that runs until it breaks. I think that's the difference between a netadmin and a fake netadmin -- a fake netadmin like me reacts. A real netadmin is proactive.

Which honestly, as pathetic as it sounds on the surface, works fairly well when your data and uptime don't matter. Because it's not pathetic because I have better things to do with my time than "run the family webserver".

Re:this is common

[xaxa]

I got bored with being a "netadmin" once I started university. I moved my family's email to Google Apps, stopped giving free webspace to anyone that didn't already know what "SSH" meant, and haven't regretted it one bit.

I do still have the server, but it only runs Apache. I looked into hosting, but I use ~20GB for photographs. Hosting for that is too expensive.

(Although, I did run aptitude dist-upgrade every couple of months so probably wouldn't have been hit by this problem.)

Re:this is common

[rdtreefrog]

I hate being called a fake netadmin, but there is no denying that you are right on this one.

Re:this is common

[digitalsushi]

I can accept that; how can we fix the 99% of us running broken due to apathy?

Re:this is common

[lukas84]

I think that's normal and is called "growing up".

During my apprenticeship, i started running my own web server, mail, dns, everything. I've learned a lot with that.

Then that machine (running a mostly broken Debian woody, with several self-made packages, several unstable packages from various points in time, and i setup i hardly understood anymore) finally broke. I've replaced it with a new one, made everything much simpler, using only standard packages, turned up cron-apt for everything, including automatic reboots.

All the critical stuff (Mail, DNS) is outsourced now. Google Apps & PowerDNS Express. I know i should've used BPOS instead of Google Apps, but it's more expensive and Gmail is a lot better for handling my private Mail than OWA is.

No fallback ?

[morcego]

People with critical servers that don't have fallback configurations to handle this kind of thing deserve to have their servers shutdown.

I've been using 0.95 for some time now, so none of my servers were affected but, even if they were, my servers are smart enough not to interrupt the services, and to notify me.

It is really disgusting the way people build servers these days. They think all they need to do is to install a couple packages, change a couple config lines and boom, the server is ready. They are getting what they asked for when stuff like this happens.

Re:No fallback ?

[0racle]

I don't know, I think I'd rather mail pile up in the queue if my spam or AV product broke. I think I'd do something like this on purpose.

Re:No fallback ?

[Fiznarp]

Yeah, noone really got hurt here.. just some delayed mail. I logged into my effected server and had clamav upgraded in 10 mins. It wasn't ideal but now I know I should have subscribed to the mailing list!

Re:No fallback ?

[1s44c]

I had two mail servers, on two Internet connections. If either went down I'd get an alert and could fix it without mail being affected. I didn't expect both to stop processing mail at the same time. It's always the stuff you don't expect to fail that fails.

My mail was queued on DMZ mailers so nothing was lost, but it was delayed. Some of it may have been business critical.

Re:No fallback ?

[morcego]

"Passing e-mails without checking in case the AV failed" is not really a fallback, at least not one I would recommend.

I was talking about having a second, different AV for that.

Re:No fallback ?

[Keruo]

> It is really disgusting the way people build servers these days. They think all they need to do is to install a couple packages, change a couple config lines and boom, the server is ready. They are getting what they asked for when stuff like this happens.

Well, you probably have proper budget and are paid enough to actually care about things like fallback configurations.

If you have shoelace budget for software and hand-down hardware for servers in addition of having hourly salary comparable to the janitor, you tend to take the easy route.

Re:No fallback ?

[NuShrike]

Probably costs too much mental power to sign up to the announce list for leeching free software critical to your operation. Too busy taking a dump?

Re:No fallback ?

[jim_v2000]

>It is really disgusting the way people build servers these days. They think all they need to do is to install a couple packages, change a couple config lines and boom, the server is ready.

Experience is the best, and often only, teacher. Sometimes there is no way to learn something other than dealing with it.

Re:No fallback ?

[1s44c]

1s44c, please don't take this as criticism toward you. I'm just taking this as an example.

Most people on IT really have no idea what high-availability is.

All criticism gratefully accepted. I'd tend to agree that many people in IT really don't have much idea what they are doing.

Basicly, you are right. However the costs involved in reimplementing a second email server using all different hardware and all different software are significant. I could do it but it would take at least twice as long, I'd hit twice the bugs, and have twice the security issues to consider. It would be hard to explain why half the mail was processed by one MTA with one virus scanner and the other half was processed by something else.

Even that would just remove one single point of failure. The registrars could still screw up my domain, a large power outage could take everything down, A routing misconfiguration in China could reroute one of my mailers IPs to someone else's mailserver which would reject my mail. The government could require ISPs to intercept my mail with unintended results. Between us we could no doubt come up with a list of a hundred things that could go wrong and still get hit by the one thing we didn't predict the next day.

*Correction*

[Slipped_Disk]

The method SourceFire chose to use was to encode a kill command in the ClamAV updates. If they had simply "shut down the [update] server" ClamAV would have continued to work, just without new signatures.

See their announcement at http://www.clamav.net/lang/en/2009/10/05/eol-clamav-094/

Re:*Correction*

[WrongSizeGlass]

From the link:

Starting from 15 April 2010 our CVD will contain a special signature which disables all clamd installations older than 0.95 – that is to say older than 1 year.

[snip]

We recommend that you always run the latest version of ClamAV to get optimal protection, reliability and performance.

Thanks for your cooperation!

FYI, ClamAV, DOA != cooperation.

Re:*Correction*

[gumbi west]

So, they did the right thing. What is the big deal?

Re:*Correction*

[Anonymous Coward]

Wow. They could have just stopped publishing updates for older versions; they do have some method of versioning, right?. Older installations could have kept chugging along using the older definitions and newer installations could get the newer definitions. But to remotely *DISABLE* older installations? I don't care if the product and service is free or not; that is pretty fucked up.

Re:*Correction*

[HarrySquatter]

What's fucked up about it? It's a huge security problem to be running an email server that is using a virus scanner whose definitions are over a year old.

Re:*Correction*

[jargonCCNA]

That’s a very good thing to point outstill, though, it’s certainly not fair that having ClamAV get administratively killed from afar means that your email service coughs and dies.

Re:*Correction*

[GungaDan]

Definitions were upgraded, though, weren't they? Just the engine was a year old...

Re:*Correction*

[compro01]

The definitions were up to date (but would become out of date when they started pushing large (>980 bytes) definition updates next month, which the old version cannot handle), but the version was not.

Re:*Correction*

[Buelldozer]

No.

Look for the post by ccandreva to explain why.

Re:*Correction*

[petermgreen]

I personally consider use of a remote signature update system as a kill switch to be abuse of the update system.

Re:*Correction*

[Slipped_Disk]

Well, you *can* configure your email system in such a way that when ClamAV goes away it still passes mail (though obviously most people, myself included, do not configure our systems that way).

That's an admin's choice to make, and like almost every choice there are tradeoffs: Potentially pass virus-laden mail, or potentially queue/defer/reject mail until the scanner comes back on line.

Re:*Correction*

[jargonCCNA]

Can, sure, but it sounds like that isn’t the default action. While the default’s safer, and I’m all for safety in my systems, too many end users have become too dependent on email for it to suddenly go away because of a package failure like that. It’s especially disturbing, reading TFA, to find that a lot of high-profile spam services abruptly shut down as a result. Those guys should have been ready for it.

Re:*Correction*

[geekmansworld]

Thank you.

I would have been happy as a ... clam... if the way this went down was for me to simply find my log files full of warnings this morning.

Instead, SourceFire chose to willfully break people's mail configurations, causing a huge amount of stress for those of us who are mail system maintainers.

Re:*Correction*

[Dan667]

if you are not going to really be using it, why not just uninstall it? Virus checkers are only effective if kept up to date.

Re:*Correction*

[Binestar]

Maintainer? More like a "It hasn't crashed? YAY!"-er. You've been getting warnings for a long time saying that the scanner was out of date and how can you justify running an out of date virus scanner and calling yourself a maintainer?

Re:*Correction*

[DavidTC]

Yeah, I feel the same way about our mail virus scanner.

I'm using amavisd-new to reject spam in real-time, and that sorta came with clamav support and I just went and turned on anti-virus updates. Frankly, I have no idea how useful it is.

Everyone should be running antivirus on their desktop. Rejecting viruses is actually more time consuming than just letting them in. If this is going to be some hassle, I'll just disable it.

Re:*Correction*

[Capt.DrumkenBum]

Can you not see the security risk of just not updating the definition files?
If they stopped updating the files that in a few months you might as well not be running and AV software.
They did exactly the right thing, in exactly the right way.

Re:*Correction*

[juhaz]

I would have been happy as a ... clam... if the way this went down was for me to simply find my log files full of warnings this morning.

Your log files have been full of warnings for half a year. You've ignored them. You WOULD have ignored the warnings this morning too, stop kidding yourself.

Re:*Correction*

[juhaz]

Definitions were upgraded, though, weren't they? Just the engine was a year old...

For now. But they would not have been any longer.

That's what this is about, the definition updates grew over some size limit that triggers a bug in the older engine version, so they could either stop sending updates to them, or send an update that breaks the old engine. They chose to do the latter to avoid false sense of security, and also managed to include an error message in the update to tell people what it's about.

Tisk, tisk...

[fuzzyfuzzyfungus]

Should have switched to Norton. They would have had weeks of impossible-to-ignore yellow and black pop-ups demanding their credit card number as ample warning...

Those freetards just don't understand the valuable features provided by quality proprietary software.

Re:Tisk, tisk...

[tendrousbeastie]

If only there were an 'Ironic' mod...

I was hit hard too...!

[bogaboga]

...and guess what! I'm almost sure I have had enough of free software.

Not to say that it odes not do its work but because there is no incentive "not to break stuff", read 'continued revenue streams', folks just do as they please and we get hurt.

Heck! Is this the "freedom" you want?

Re:I was hit hard too...!

[biryokumaru]

Heck! Is this the "freedom" you want?

What, the freedom for your system to be very slightly unstable if you fail to upgrade a piece of software a year out of date after six months of warnings?

Re:I was hit hard too...!

[NuShrike]

Yes, because you're not paying for it! Do you expect companies who have to make a buck be nice to leechers like you?

When was the last time you donated to OpenBSD for all their contributions such as OpenSSH? If so many of your are going to be evil leechers, then companies have no choice and all the say.

Re:I was hit hard too...!

[morcego]

You know the "free" part there doesn't mean you are free not to do a good job, right ? Because, you know, you are not.

People still should know what they are doing. I never saw this announcement regarding 0.94, but nevertheless, none of my servers stopped.

Re:I was hit hard too...!

[MasterPatricko]

Having a working but out-of-date antivirus solution can be considered to be worse than having no antivirus solution at all, because it gives pretense of security that isn't really there. You might never have upgraded if they hadn't killed the old version forcibly.

And if you bothered to RTFA you would learn that there was a bug in old versions that was basically eating their bandwidth. Considering that you aren't contributing to their upkeep costs, they definitely have the right to do something about it unilaterally.

Considering the updates are FREE, and they gave you SIX MONTHS warning, they did the right thing.

Re:I was hit hard too...!

[thePowerOfGrayskull]

Heck! Is this the "freedom" you want?

Yes, thanks. While I have seen some frustrating breakages in OSS before (I recall several different Ubuntu updates that broke Xorg, the bastards), this isn't one of them. The software is a year out of date. You're given six months warning. Continuing to run after that time (if it were possible) would mean that your long-outdated version is no longer receiving definition updates -- so you'd be left with a false sense of security that you're somehow protected when you weren't.

if they had just issued a routine update that broke servers that's one thing. But they've been announcing this for six months. If you were on clamav-announce list (the ONLY way they have to get in contact with users otherwise too busy to check their web site) you would have learned about this long before it was an issue.

Even a month ago, you probably could have used that freedom to set up your own server and use outdated definitions for years to come. Now it's down to the wire, and it sounds like you don't have that luxury... but is that their fault? They communicated well in advance. Why blame them because you weren't listening?

Re:I was hit hard too...!

[Lumpy]

Why because you were too lazy to update your AV software from a year ago?

ClamAV did the right thing, they could have simply shoved out the new AV database that would have had your AV crash with a wierd error, because your horribly out of date version was incompatible with the new larger database format. but no they made sure you had a informative error so you would know what to do.

But it's their fault and OSS fault... DAMN THOSE OSS PEOPLE!

Re:I was hit hard too...!

[pizzach]

Um. Then get something like RHEL and be done with it. They specialize in keeping everything as stable as possible (and yes you pay for it.) It sounds like you are using the wrong product for your needs.

Re:I was hit hard too...!

[Kijori]

...and guess what! I'm almost sure I have had enough of free software.

Not to say that it odes not do its work but because there is no incentive "not to break stuff", read 'continued revenue streams', folks just do as they please and we get hurt.

Heck! Is this the "freedom" you want?

For six months their web site, the clamav-announce mailing list and your log files have over and over again explained that the version was out of date and would be discontinued; it's not like this just happened overnight. But that's not even the point.

The point is that this was in your best interests, although it may not seem like it now. Given that you hadn't updated for six months they could be pretty sure you weren't going to upgrade now; most likely you don't check the log files or the mailing lists because you probably aren't a full-time server admin and don't have time to check every package you use. So they could have continued to alert you every few days through the log files and the mailing lists, and updated the newer versions from a different source, but then you most likely wouldn't have realized when your virus protection silently slipped further and further out of date until it provided no protection at all and the virus scanning became totally useless.

At the end of the day they were making a choice between two options: leave you, without you realizing anything had changed, with no real virus protection, or bring it to your attention more forcefully than through the log files and mailing lists. While I can sympathise with your position, especially if you had to come into work specially to fix it, it's much less work than if you had to clean up a virus that got through later on.

Re:I was hit hard too...!

[_Sprocket_]

Not to say that it odes not do its work but because there is no incentive "not to break stuff", read 'continued revenue streams', folks just do as they please and we get hurt.

This might shock you, but when revenue steams are involved, there's still no guarantee of an incentive to "not to break stuff."

Re:I was hit hard too...!

[idontgno]

Or, better yet, get something like CentOS and leech shamelessly off the care and craftsmanship of the fine Redhat people AT NO COST!

-- A proud CentOS user

Of course, buying from RH means buying into a team, and not having to go it alone. At worst, that means you have someone else to blame.

Re:I was hit hard too...!

[Golden_Rider]

...and guess what! I'm almost sure I have had enough of free software.

Not to say that it odes not do its work but because there is no incentive "not to break stuff", read 'continued revenue streams', folks just do as they please and we get hurt.

Heck! Is this the "freedom" you want?

What would you rather have, the software being deactivated, so that you NOTICE something is wrong and are able to fix it, or the software keeping running with update error messages in the logs (which you obviously never read, else you would have noticed the error message which WERE there for months now), and in another couple months your whole company is screwed and data is lost because of some virus/trojan which got through the non-updated virus scanner?

Re:I was hit hard too...!

[sjames]

Same thing happens with proprietary software except they have more incentive to do it!

Re:I was hit hard too...!

[StuartHankins]

I don't believe proprietary software will fix your level of incompetency if you got "hit hard" by this.

Let's see, you didn't check your logs, you didn't verify it was updating regularly, you missed the news on their site... absolutely amazing. Did you expect them to send someone to knock on your door?

You seem to think this is an "open source" problem which shows your lack of comprehension at your own fail. Do you still have the box your computer came in? Yeah, use it to ship the computer somewhere else -- anywhere else -- because it's unlikely the recipient will be as clueless as you.

so clam breaks if a remote server is down?

[codepunk]

If it breaks because a remote server went away it sounds like it is time to possibly have another look at that code.

Re:so clam breaks if a remote server is down?

[mysidia]

It wasn't the server going away. They delivered an update designed to kill it

The Windows equivalent would be Microsoft Delivering a critical update with XP designed to disable windows, because you haven't updated to Vista yet.

In other words, they used the automatic update service against their own users.

From now on, my recommended course of action is that all mail administrators running clamav should REMOVE or DISABLE any automatic updates of ClamAV rules, make sure to comment out any crontab entries for freshclam.

Until the developers can either grow up and stop doing stupid shit such as abusing auto-updates to disable their own product.

Or do what they should do... include a method for automatically applying version updates.

Or force auto version update instead of disabling.

Re:so clam breaks if a remote server is down?

[compro01]

It isn't a remote server shutting down, they issued a "signature" update that caused each installation of a version prior to 0.95 to stop functioning.

Re:so clam breaks if a remote server is down?

[X0563511]

You could try taking another look at the problem.

The server is up. It specifically tells 0.94.x and earlier that "thou art broken"

Re:so clam breaks if a remote server is down?

[Nasarius]

The Windows equivalent would be Microsoft Delivering a critical update with XP designed to disable windows, because you haven't updated to Vista yet.

No, not even remotely close. Upgrading ClamAV is trivial and costs nothing. If you're not keeping your security software up to date, you've failed utterly.

Re:so clam breaks if a remote server is down?

[Lumpy]

Nice FUD. the new DB will break it anyways.. and YES microsoft does this.

They crafted a DB update that used that bug to deliver a message so the logs showed you what happened instead of a "seg fault - error in line 45867"

Re:so clam breaks if a remote server is down?

[Buelldozer]

What were they supposed to do exactly?

They've been warning users for 6 months that this was coming. The new style signature files for .95 and up were GOING to crash .94 installations. They're mirrors can't support supplying both old and new style signatures and the .95+ clients would have been _less secure_ because of a constrained signature file size. On top of all that if you'd go read their statement they ALSO cannot support an auto upgrade to .95 because of server constraints.

Also, I have a feeling that if they had found a way to force everyone to .95 we would have had people on here screaming about how the forced update broke their server and that they shouldn't have done that.

Face it, they gave six months warning. You, and everyone else, had plenty of time to get their poop in a group and upgrade to the latest package.

Re:so clam breaks if a remote server is down?

[geekthesteve]

Could not agree more with your post. I take care of the network here at work as a part of my job and IT is nowhere near the top of my list. I run a Zimbra mail server and barely know clamAV is even there. Yesterday at 3:20 PM not only did virus scanning stop but it also kept my server from relaying mail messages. I have been in the IT field since 1981 and had thought I had seen it all until this happened. I have had many vendors mess up and not be able to fix a problem but have never had one go out of their way to create a problem for their users. I got my server running and it seems to be running today (I will be checking the Zimbra forums this weekend to find out what I need to do longer range) but I certainly hope that this gets addressed by ZImbra. If not, I will simply dump Zimbra and give in to the owner's biases here and implement Exchange (just before I start sending out resumes).

Re:so clam breaks if a remote server is down?

[Slashdot Parent]

From now on, my recommended course of action is that all mail administrators running clamav should REMOVE or DISABLE any automatic updates of ClamAV rules, make sure to comment out any crontab entries for freshclam.

If you're not going to keep the virus signatures up to date, what's the point of even running it?

It's a little shocking to me that anyone was caught by surprise on this. Ubuntu and Debian volatile are running 0.95+. I assume the other distros are, as well.

If you don't intend to apply the security fixes to your server, do not run a server. Pay somebody else to do it for you.

Re:so clam breaks if a remote server is down?

[Kijori]

Nice FUD. the new DB will break it anyways.. and YES microsoft does this.

They crafted a DB update that used that bug to deliver a message so the logs showed you what happened instead of a "seg fault - error in line 45867"

While that's true it's not like they couldn't have avoided this situation: the newer, larger updates could easily have been furnished from a different source, thereby avoiding the problem.

But as I've posted further up, that's not really the point; when the virus definitions got bigger the old versions would go out of date and not provide the protection people thought they had. The choice they were making was between causing people temporary annoyance - and I don't mean to trivialise, I fully accept that this was probably really, really annoying - or letting those peoples networks lose their virus protection without anyone noticing, which could (would?) lead to much more annoying and expensive consequences.

Personally I think it was the right thing to do, but then that's easy for me to say - I don't administer a mail server.

Re:so clam breaks if a remote server is down?

[NuShrike]

You're so off the field that you shouldn't comment.

This is more like Microsoft sending an update to disable your auto-updates because you refused to update to SP2 for a full year, and then the software refuses to run without auto-updates running.

Since all the patches are now based off SP2, you're forcing them to maintain full roll-up patches which are killing their FREE service servers. So update to SP2, or you're SOL.

Re:so clam breaks if a remote server is down?

[cbreak]

A virus scanner with out of date sigs is worthless. One with an out of date engine is worthless. Disabling it is more honest than patching it up to pretend to still work.

Re:so clam breaks if a remote server is down?

[mysidia]

They should have altered their update servers to no longer deliver new update files to .94 installations.

The admins could then notice freshclam failures, or 'patterns not up to date' on their spam filtering devices' web interfaces.

Which is a better outcome for them than lost critical e-mail.

Re:so clam breaks if a remote server is down?

[mysidia]

You're way off base. The ClamAV folks delivered a patterns update that disables the virus scanner, and causes it to return an error every time you try to scan something.

This effectively kills the software when the update is loaded.

I wouldn't be complaining if they had only modified their update servers to deny the ability for 0.94 installations to download antivirus rules.

Re:so clam breaks if a remote server is down?

[mysidia]

That response is utter nonsense. A virus scanner with sigs that are 6 months old has less value than one which is completely up to date, but that lesser value is not zero.

Delivering an update to disable an AV is destructive, when instead they should have simply refused to deliver patterns updates to the out-of-date AV.

Most viruses spreading via e-mail are very old ones that could be detected even if the patterns are over a year old.

Whether an upgrade is going to be done is properly the system admin's decision alone, and may be influenced whether there is a large outbreak of a new virus.

Re:so clam breaks if a remote server is down?

[mysidia]

No, not even remotely close. Upgrading ClamAV is trivial and costs nothing.

It costs something, especially for organizations who don't have dedicated staff to handle that and pay consultants/contracters by the hour for technical services.

People may be running ClamAV who don't even know they are running ClamAV, by the way.

I guess maybe their consultant is to blame and they should fired, since they deployed ClamAV in production, which obviously was not reliable: instead they should have bought a professional AV product..

Re:so clam breaks if a remote server is down?

[petermgreen]

Indeed clamav were stuck between a rock and a hard place on this one. Whichever option they chose some people would say it was the wrong one.

The real problem is that there was no effective way of communicating this to users. People clearly either didn't read logs or took the "don't panic" part of the log message a bit to literally and didn't realise they should be subscribed to the announce list for the virus scanner.

Desktop AV posts lots of nag messages to the screen when updates are going to be discontinued but that isn't really practical for an AV that is both running on a server and only a small part of the larger soloution (in the unix traditions of ways of doing things).

Further compounding the problem is that Debian put clamav in stable and then abandoned the version in stable telling users to use the one from volatile (because ClamAV had made changes that weren't acceptable within a stable release) but not everyone knows about volatile (it's a relatively recent addition). Most likely in future releases Debian will only put clamav in volatile.

Re:so clam breaks if a remote server is down?

[petermgreen]

If you don't intend to apply the security fixes to your server, do not run a server.
Afaict a lot of debian users think (and the messages in the installer and the information on the website implies it) that if they have the security repositry in the sources.list and run apt-get update && apt-get upgrade (or the equivalent commands for their preferred high level package manager) frequently that they have done all they reasonably can do regarding keeping their server patched.

However this is NOT enough. Sometimes the debian security team will consider a version of something unsupportable before security support for the release in general is discontinued. Users needing security support for said package need to make other arrangements (e.g. using volatile). However they will only know that they need to do so if they subscribe to the debian-security-announce mailing list. This fact is NOT well communicated to users (the debian page on "security information" makes no mention of this fact!).

If you are running Debian on a server and are not subscribed to that list I suggest you both subscribe to it ASAP AND go through the list archives! If you run another distribution I suggest you check for a similar list there.

EOL annountment from Oct 2009

[Anonymous Coward]

End of Life Announcement: ClamAV 0.94.x
Oct 5, 2009

All ClamAV releases older than 0.95 are affected by a bug in freshclam which prevents incremental updates from working with signatures longer than 980 bytes.
You can find more details on this issue on our bugzilla (see bug #1395)

This move is needed to push more people to upgrade to 0.95 .
We would like to keep on supporting all old versions of our engine, but unfortunately this is no longer possible without causing a disservice to people running a recent release of ClamAV.
The traffic generated by a full CVD download, as opposed to an incremental update, cannot be sustained by our mirrors.

We plan to start releasing signatures which exceed the 980 bytes limit on May 2010.

We recommend that you always run the latest version of ClamAV to get optimal protection, reliability and performance.

Thanks for your cooperation!

Re:FUCK JEWS

[jDeepbeep]

FUCK JEWS

When they are exceedingly attractive, female, not married, and expressing interest, I do.

Hm...

[Knara]

IIRC, ClamAV doesn't have real-time scanning anyway. Does it have a first party mail server scanning plugin now, or am I totally misunderstanding the issue here.

Re:Hm...

[Anonymous Coward]

IIRC, ClamAV doesn't have real-time scanning anyway. Does it have a first party mail server scanning plugin now, or am I totally misunderstanding the issue here.

yes it does and has had it for a while

[me@server clamav-0.96] ./configure --enable-milter

works with sendmail and postfix

Re:It's not like they didn't tell...

[mysidia]

SUPPORT WILL END does not imply killing instances in production. It implies you stop delivering support services (such as tech support or new updates).

How would you feel if the Ubuntu folks delivered a 'security update' to Ubuntu 8.x to disable your system entirely, until you can get a chance to go install a non-EOL'd major release of your OS?

How about all those Windows Vista users who haven't upgraded to Windows 7?

Firefox 2 users who haven't upgraded to 3.

Users who are still using IE6.

Would users trust the vendors anymore with auto-updates, if they all released updates to 'kill the old product' in order to force you to manually do a clean upgrade?

Yes, they did the right thing...

[Slipped_Disk]

As someone who was bitten by the issue (yeah, I'll man up and admit it - my company's mail server went wonky for about a half hour while I upgraded) I agree -- they pretty much did the right thing.

There was plenty of notice -- The fact that many of us weren't on the clamav-announce list is OUR fault, not theirs.
A kill command may not be the most "polite" way of retiring an old version of software, but for a free service I certainly don't expect them to invest huge amounts of time and money in figuring out how to support the old stuff forever.

Re:Yes, they did the right thing...

[syousef]

A kill command may not be the most "polite" way of retiring an old version of software, but for a free service I certainly don't expect them to invest huge amounts of time and money in figuring out how to support the old stuff forever.

Just because a company provides you with free software does not mean they get to disrupt your business.

Just because you make a mistake of being on a list does not mean a company gets to disrupt your business.

There is no point in even having antivirus software if you're happy for it to do things that screw up your servers. In that case it is the virus and you have intentionally installed it.

What if someone works out how to send you an final signature prematurely in order to shut down your business?

The software should have stopped accepting updates. It's not a question of politeness.

People have lost the plot when it comes to security.

Re:Yes, they did the right thing...

[jim_v2000]

They didn't install their software on your servers, YOU did. So they didn't disrupt your business, YOU did. Whether it's because you were ignorant or lazy is irrelevant. It still comes down to YOU.

Re:Yes, they did the right thing...

[syousef]

They didn't install their software on your servers, YOU did. So they didn't disrupt your business, YOU did. Whether it's because you were ignorant or lazy is irrelevant. It still comes down to YOU.

Actually I don't use the software, so I did nothing.

THEY chose to send a software update which they knew would disable their customer's antivirus. THEY did do something. YOU are a fool for refusing to accept that.

Debian Debs Outdated

[TypoNAM]

I just tried to update:

# cat /etc/debian_version
5.0.4

aptitude output during update:

Setting up clamav-daemon (0.94.dfsg.2-1lenny2) ...
Starting ClamAV daemon: clamd LibClamAV Warning:
LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***
LibClamAV Warning:
LibClamAV Error: cli_hex2str(): Malformed hexstring: This ClamAV version has reached End of Life! Please upgrade to version 0.95 or later. For more information see www.clamav.net/eol-clamav-094 and www.clamav.net/download (length: 169)
LibClamAV Error: Problem parsing database at line 742
LibClamAV Error: Can't load daily.ndb: Malformed database
LibClamAV Error: cli_tgzload: Can't load daily.ndb
LibClamAV Error: Can't load /var/lib/clamav/daily.cld: Malformed database
ERROR: Malformed database

It appears debian repositories also need to be updated. :(

NOTE: I removed the * (star) chars from the warnings due to junk filter.

Re:Debian Debs Outdated

[iYk6]

The ClamAV package in Debian Lenny-Volatile is 0.95.3. You're using the package from Debian Lenny, which is stable, and doesn't mesh well with ClamAV, which is either the latest and greatest or broken.

Debian Volatile is meant specifically for this kind of thing.

Re:Debian Debs Outdated

[johnshirley]

Maybe try to uninstall and purge your existing configs then reinstall from the global repository. Might take care of it in just a few minutes.

Re:Debian Debs Outdated

[Just Some Guy]

It appears debian repositories also need to be updated. :(

In general, you may safely assume that to be the case for any given package.

Re:Debian Debs Outdated

[Slashdot Parent]

Debian Volatile is meant specifically for this kind of thing.

And indeed I'm running stable-volatile for my mail server, so I never would have found out about this, had it not been posted to slashdot.

But it is truly shocking to me that Debian lenny hasn't been updated via security.debian.org. I know they're under a freeze and all, but there are about a half dozen bugs filed against clamav that warned this was going to happen. Not sure what the logic was in refusing to upgrade, despite this being a well-known to the maintainer issue.

If they don't want to keep clamav stable in stable, they need to kick it out.

Re:Debian Debs Outdated

[Slashdot Parent]

It appears debian repositories also need to be updated. :(

Follow the instructions here and then do the update. You'll be up and running in a jiffy.

Re:Debian Debs Outdated

[yossarianuk]

just compile it - it takes 5 mins. 0.96 has some major changes to its scanning engine that you should not miss out on. (p.s another advantage of running Archlinux is that you will have the latest version in its repositories)

Re:Debian Debs Outdated

[Rinisari]

This forced upgrade/disabling also harms any Ubuntu Server installation running 8.04 Hardy, the last LTS release. Lucid is another LTS release, fortunately.

Re:Debian Debs Outdated

[Rinisari]

Don't I feel stupid.

0.95 is available, but 'held back' by default and must be explicitly upgraded.

Natalie and grits

[jDeepbeep]

Be careful, though. Natalie Portman might pour hot grits on you.

Where do I sign up sir?

Re:GODDAMMIT ALREADY !!

[Hognoxious]

With a name like ClamAV, my bet would be the Scientologists.

Re:It's not like they didn't tell...

[morcego]

Or maybe people should ... you know ... not apply updates directly to their production servers without testing them first ?

No, that would be too radical. Who ever heard of updates causing problems ? It would never happen.

What the fuck Slashdot?

[wolrahnaes]

First you complain when Microsoft releases an update that won't install on compromised systems because it would break them entirely.

Now ClamAV is put in a similar position. They have three choices due to the bug in 0.94:
1. Continue supporting 0.94, flood out their update servers with full updates since incrementals won't work with that version much longer.
2. Stop supporting 0.94, leaving users who don't know to update basically unprotected.
3. Send a clear message to users who haven't updated that their antivirus solution is now broken and they need to upgrade.

To me, 3 is the obvious choice. If this was a paid solution or if it cost a fucking dime to upgrade I might see a point to complaining, but to anyone who was still using 0.94 just man the fuck up, apt-get update, apt-get upgrade, and get on with it.

This is not like Microsoft disabling XP to get you to upgrade to Vista, this is more comparable to an aircraft with faulty parts being grounded by the FAA. Those using 0.94 were doomed to a broken solution one way or another, they could not continue using it and expect it to do its job, so they needed a kick in the ass to upgrade.

Re:What the fuck Slashdot?

[BassMan449]

wolrahnaes is exactly right. ClamAV was put in a position where they could easily end up with many email servers running with out of date antivirus definitions, but still think everything was working great. That is far more serious of a situation then stalling a few peoples email queues to force them to update. Had they silently stopped updating it would be way to easy for newly written viruses to spread because you would have such a large group of people who thought they were protected but weren't.

Re:What the fuck Slashdot?

[doogledog]

Are you saying that /. should become an OSS announce website? But then there won't be room for all the iStories and Microsoft bashing as well!

Re:What the fuck Slashdot?

[_Sprocket_]

This might come as a surprise... but a large part of Slashdot is covering stories and discussing them. Sometimes the stories are based on unsound reasoning, wide-spread misunderstanding, or simple controversy. The existence of a story is not an indicator that any given story has validity. In fact, there are times that a story is posted solely for the value of discussion. I, personally, find that these are especially handy as I can come away with multiple viewpoints and additional information on a subject.

Re:What the fuck Slashdot?

[wolrahnaes]

There's nothing inherently wrong with that idea, but the headline and article text here are pretty much straight out of Fox News they're so panicy. If one didn't know any better, one might come away from that thinking ClamAV did something wrong or even malicious.

Re:What the fuck Slashdot?

[_Sprocket_]

If one didn't know any better, one might come away from that thinking ClamAV did something wrong or even malicious.

There certainly are people who apparently feel that it was wrong (and maybe even malicious). I disagree. But that does seem to be part of the discussion. That you and I find it all rather sensationalist reactions by people who should've known better is also part of that discussion.

I suppose my view is less "what the heck does Slashdot think its doing" and more "what the heck do these people think they're doing?"

Re:What the fuck Slashdot?

[Qzukk]

If this was posted to Slashdot yesterday

It's probably in the queue to be posted tomorrow.

Re:What the fuck Slashdot?

[kimvette]

Why not? It could replace a slashvertisement or Idle post on a slow day.

What would you rather read about: some shmuck who has poor balance and fell off her wii fit (and will likely sue Nintendo for not pasting a warning label reading "Note: if you are a klutz you might fall off, injure a nerve and become permanently horny", or that an OSS project is pushing out a time bomb to bring their app down? I come here for tech news, not lazy, uncoordinated clod news.

Re:What the fuck Slashdot?

[syousef]

2. Stop supporting 0.94, leaving users who don't know to update basically unprotected..

Unprotected against new viruses is not the same as unprotected. Sending a final update critically broke the system. You're saying that's okay just to get the user's attention so that they're forced to upgrade. But the purpose of the antivirus tool is to prevent risk and impact on the business. In this case the update WAS the virus.

Re:It's not like they didn't tell...

[wolrahnaes]

If any of those examples were providing services where support ending means the thing is not doing its job anymore, you might have a point.

In this case, no more updates for 0.94 means 0.94 effectively does not work. There is nothing at all preventing any user from upgrading to the current version, so there's nothing wrong with forcing them to do so when the old solution is no longer working.

Overconfidence

[gmuslera]

A lot of server stuff in linux work so well that you can even forget that it is running at all, for years. Clamav is such kind of software, you install/configure it, set the automatic signature updates, and forget that it is there. But still, some periodic checks in logs that all are working as expected is good, even if is just some artificial ignorance well applied, specially when clamav started warning on this months ago.

Re:It's not like they didn't tell...

[VoxMagis]

I totally agree. I was bitten by this on several servers. The sad part is that in some cases this is NOT really always our choice here.

Sometimes management or customers (in my case) CHOOSE to not allow me to spend the time or money to do more than the minimums. In this current economy, it's become a serious situation.

I really appreciate CLAM and the coders that support and maintain it. It is their prerogative to make the call. I just wish they would have done it differently. If a closed-vendor did this (see the examples in the parent post), there would be geek-riots in the street.

I was lucky - I had been planning this move for awhile, so I had everything happy rather quickly.

Now, on another note - if the maintainers had pushed an announcement of the result of this plan to Slashdot, Digg, etc. maybe there would be less howling. I have to maintain MANY different Open Source products, no matter how hard I try, I can't keep track of each of them through web pages and announce lists.

Re:It's not like they didn't tell...

[Slipped_Disk]

Or maybe people should ... you know ... not apply updates directly to their production servers without testing them first ?

No, that would be too radical. Who ever heard of updates causing problems ? It would never happen.

Tell me, do you sandbox a full environment and test every virus signature update prior to rolling it out?
If so, what is the length of your pre-deployment testing cycle? How many people are dedicated to your test team, and how do you justify their salaries?

(Not trying to be a dick, I'm genuinely curious if anyone goes to this level of overkill, and how they manage to get it approved. I had to fight uphill both ways in the snow to get a dev environment built...)

Misleading, yes?

[thePowerOfGrayskull]

"ClamAV forced upgrade breaks email servers" should read "Failure to upgrade despite six months warning breaks email servers" or "Inattentive server admins cause massive downtime".

Re:Misleading, yes?

[syousef]

"ClamAV forced upgrade breaks email servers" should read "Failure to upgrade despite six months warning breaks email servers" or "Inattentive server admins cause massive downtime".

If ClamAV caused downtime by doing something to the system that broke it, ClamAV is the virus. Anti-virus software is suppose to prevent disruption of your system due to malware trying to do things with it that you did not intend.

What if someone had worked out a way to exploit the kill switch built into the server? Are you happy with other people being able to remotely kill your software? If so, you have no business commenting.

Re:It's not like they didn't tell...

[natehoy]

The problem here is that once support services end, they stop writing new signatures for the old version of ClamAV. If an administrator has been ignoring (or has been unaware of) the impending end-of-life of ClamAV for the past 6 months, they are going to remain unaware of the problem basically forever.

There are four ways to handle this:

1. Contact all of your users. How?? Those who have subscribed to the updates list already know. You don't have to register to have ClamAV, so for most of the rest they won't have an email address.

2. Make the software tell the user it is about to expire. How?? There isn't a communications process written into ClamAV that can send a signal up to the GUI and most people don't monitor every line of their syslogs.

3. Just shut down the update server so you won't offer the users signature updates any more. Users will continue along for long periods of time with increasingly outdated antivirus definitions. This is a really, really bad idea.

4. Give people ample warning over as many channels as you can, then break it so people notice that something is wrong.

#4 is not ideal. But it's the best of the options.

Personally, I have ClamAV on all of my machines, but it's the Ubuntu/Mint supported version out of the repositories, so it gets updated. I think ClamAV would be well-served putting up Debian and RPM repositories and making people install the software using the repos, and not offering it for direct download any more.

Re:It's not like they didn't tell...

[Drizzt Do'Urden]

Anti-Virus updates are considered priorities here.

It is tested on a server, if it works good we update production. It takes less than 15min of my time..

Re:It's not like they didn't tell...

[Buelldozer]

You're missing the fundamental issue. Upgrading to .95 _was_ the minimum requirement. You should have gone to your clients and said "This work needs to be performed to keep your AntiVirus current for your email server.".

Re:FUCK JEWS

[Enderandrew]

This is the best Slashdot post I've read all week.

Re:It's not like they didn't tell...

[Drizzt Do'Urden]

Exactly!

Anyways, the e-mail telling thing will break as been sent many times..

Re: automatic binary updates

[Slipped_Disk]

From now on, my recommended course of action is that all mail administrators running clamav should REMOVE or DISABLE any automatic updates of ClamAV rules, make sure to comment out any crontab entries for freshclam.

<SARCASM>
Mmhmm, yes. I agree 1000%. Don't update your virus signatures. Because ya know, new viruses don't get created very often. You can run with signatures over a year old and still have great protection!
</SARCASM>

Or do what they should do... include a method for automatically applying version updates.

Or force auto version update instead of disabling.

<SARCASM>
Yes, because distributing software for several versions of Free/Net/OpenBSD, each Linux distribution, Windows, Solaris, AIX, HP-UX, etc. is totally feasible for a free project.

It's not like they would have to fund the time, equipment and distribution bandwidth for that, or have to deal with irate admins screaming about how ClamAV breaks their change control policies by automatically installing binaries on production servers.

And software with automatic updates never ships an update that bricks production servers (*cough*Exchange*cough*), so this is a perfect solution.
</SARCASM>

Sometimes I really wonder what happened to the Slashdot crowd's common sense.

Package Managers

[Slashdot Parent]

This is why you rely on package management software. There are actual maintainers out there who keep up-to-date on issues like this, that affect their packages.

For instance, if you're running any version of Ubuntu, you are on v0.95.3 or v0.96 right now, so you would not have even known about this EOL had it not been on slashdot. Every time you log into Ubuntu, it will warn you if you need to do some updates.

If you are not a professional system administrator (neither am I, by the way, so I feel for you), you should not bother trying to subscribe to all of the mailing lists for all of the packages you use. You should instead rely on the hard, thankless work put in by the package maintainers to keep you out of trouble.

Make sure you do the security updates for your distro of choice. Choose a stable release of your distro if you don't enjoy constant upgrades.

Re:Package Managers

[ulzeraj]

My mail filtering gateway runs on a FreeBSD 8.0 jail with ClamAV 0.95.3 installed from Ports. It relays the messages to our real mail server, still running Debian (Lenny, but the Squeeze repositiores are still providing 0.94). Since I've moved all the mail checking software to the FreeBSD mailgw (amavis, spamassassin, clamav etc), my mail services are alive and kicking. I do however keep some other Clamavs running in Debian Squid servers with HAVP and that worries me a bit.

Re:Package Managers

[Qzukk]

Debian created the -volatile repositories about 5 years ago ( http://www.debian.org/volatile/ ) for keeping up with antivirus and spamcheckers that must be upgraded or become useless.

I think Debian dropped the ball here, Lenny should have shipped with the lenny-volatile repository at least commented out (if not enabled by default), and all of the packages in -volatile being only in -volatile so that people would enable the repository to use them and get updates.

Re:Package Managers

[Slashdot Parent]

I'm a little surprised that Debian didn't release 0.95 as a security update into stable. Ubuntu did.

But I agree, the long-term solution is to boot clamav out of stable and into volatile. There is no point in running a virus-scanner that hasn't seen an update in 2 years. From the discussion on the bug tracker, it looks like that may be the plan.

Re:It's not like they didn't tell...

[natehoy]

I guess it all boils down to "which is worse":

1. A broken security tool that is obviously broken, or

2. A half-broken security tool that looks like it's working OK?

Umm, I'll take #1 for priceless security, Alex.

As soon as ClamAV stops sending out freshclam for a version, that version should fail. As spectacularly and noisily as possible. It should scream of its obsolescence from the rooftops, and prevent any service depending on it from doing jack schitt until it gets fixed.

Volatile

[XanC]

You really should use the volatile repository. It provides updated versions of packages that are required to change (like antivirus), compiled for stable. You end up with stable + required updates.

It filled up my hard drive

[Cogneato]

I woke up this morning to urgent "my site is down" calls from clients on one of my old servers. It turns out that ClamAV was trying to update itself. It would download the update, fail to update, then download again and again until it filled up the hard drive. We don't even do email on this particular server, so it must have gotten turned on months/years ago and then never noticed. We've disabled it, but it was kind of an annoying way to be woken up.

No soup for you!

[mrflash818]

Heh, good ol' Seinfeld :)

Package Managers - agreed

[mrflash818]

If you use a system that has aptitude, then it might be worth it to routinely (at least monthly?) run the following:

sudo aptitude update
sudo aptitude safe-upgrade

You'll get a lot of security updates, if they are out there, which is a good thing!

(your mileage may vary)

Re:Package Managers - agreed

[Compaqt]

What's the difference between

sudo apt-get install

and

sudo aptitude safe-upgrade ?

I assume "apt-get update" and "aptitude update" are the same underneath.

Who uses it anyway?

[Artem S. Tashkinov]

I'd likely to be modded down by open source zealots, but using Clamav to solely protect Windows PCs from malware spread by e-mail is insane. ClamAV has one of the lowest malware detection rate amongst other commercial AV solutions. I tested my own sample of around 140 new viruses found on different Windows PCs during last six months and ClamAV could detect only 70 of them. That's ridiculous ... and fearful to say at least.

Re:Who uses it anyway?

[0racle]

For as easy as it is to integrate with Postfix and Sendmail, why wouldn't you use it on your mail gateways? No one is suggesting using only ClamAV however.

Re:Who uses it anyway?

[1s44c]

So what's better?

I'd certainly consider spending money for a higher detection rate.

Re:Who uses it anyway?

[petermgreen]

I used to get many virus mails per day, since setting up clamav I get hardly any (probablly less than one a week)

I wouldn't use it as my only protection but it does a good job of clearing the flood of virus mails.

Re:Shows how out of touch

[mcmonkey]

Wow. How is that modded Troll?

For people in the real world who use servers as tools to get work done, one year is a very short time in the life of software.

Actually, I would argue the other way. Not, why are you running year old software? But rather, why are you running a version less than a year old?

I need software to get things done, not to serve as beta tester for the vendor.

You're not even close (was:FUCK JEWS)

[Lead Butthead]

Sir, you're no Mel Gibson...

Re:Shows how out of touch

[LodCrappo]

apparently you dropped the vendor of your spellchecker.

this was not standard operating procedure, this was a unique situation that required a unique solution. the clamav team made the choice that they felt was best. given the facts as I understand them, I agree with their decision.

if your IT department cannot be bothered to read the announcements for the software they use, or even to review your own server logs, then you should certainly not be using open source software. just pay someone to do this type of thing for you, as many companies do. FOSS is not for you.

Re:It's not like they didn't tell...

[myowntrueself]

SUPPORT WILL END does not imply killing instances in production.

Indeed.

Its the kind of arrogance that I'd expect more from a Microsoft or an Apple than any opensource 'vendor'.

Re:It's not like they didn't tell...

[DavidTC]

Actually, #2 happened. The software was informed, six months ago, and was constantly writing messages in the log file.

Re:Shows how out of touch

[NuShrike]

Because nobody PAID for support?

Re:Shows how out of touch

[david_thornley]

I assume, then, that I can look at any vulnerability for the past three years and be confident of exploiting it on your systems, because you won't have upgraded past that.

When security software has bugs, responsible vendors update it as soon as they safely can, and that appears to be what ClamAV did. However, not only did they not have signed service contracts, they didn't have email addresses, so they tried communicating in every way they could, for six months, that there was a serious problem with an older version. They weren't charging for the update.

If you can't keep yourself informed about your security software, and when it has problems and needs to be updated, well, your organization deserves what it gets, but lots of other people (like your customers and botnet victims) don't.

Better plan for next time...

[RedBear]

Here is what they should have done, to wake up all the system administrators who didn't happen to notice the announcements: Gradually wean people off the old version by shutting down the ClamAV server for an hour, then six hours, then a day, then three days, and finally shut it down permanently. At the end of that process I guarantee you there would be almost zero affected systems left to break after the permanent shutdown deadline. The better admins and bigger systems will notice the problem immediately during the short shutdowns and have plenty of time to upgrade. The systems that are still vulnerable after the entire weaning process need to be broken anyway so that someone will finally pay attention and fix them.

Shutting it down permanently, even after making "announcements" for a few months will never allow every single user of any product sufficient time to notice that something is about to happen. It's a simple fact of life, not every system admin is a computer expert, not every admin knows what the last admin did or is subscribed to the same mailing lists or visits the same technical websites. Stopping an external service like that on a temporary and gradually increasing basis would allow almost 100% of the end users to finally figure out or do the research to realize what was happening and upgrade their systems in time for the final permanent shutdown.

Things like this always remind me of the Hitchhiker's Guide where they posted the "announcement" that the Earth would be destroyed, giving everyone on Earth plenty of time to leave. Unfortunately the announcement was posted in an office on the home planet of the aliens who came through and destroyed the Earth, so no one on Earth ever saw it, and it was only posted for like 30 days anyway. People always have this weird idea that just because something is "announced" to a specific community that is paying attention it means that everyone else will magically know you made an announcement, but that isn't how the real world works. People also have this weird idea that not knowing everything about everything in the technical universe is somehow the same as being incompetent. The world is not perfect. Upgrade procedures and policies for any external software service must acknowledge this or suffer the wrath of the 90% of the system admin community who are NOT God-like in their omniscience.

Re:It's not like they didn't tell...

[mysidia]

No, they delivered a virus patterns update containing a rule to prevent the scanner from running at all.

If they just modified their servers to refuse to deliver updates to the old version of the software, it would not be a front page news item.

Re:Shows how out of touch

[Qzukk]

we would drop said vendor immideately

So if the vendor promised to you that they'd continue to support a 6-month-old buggy version that was incapable of downloading new virus signatures, you'd be glad to run that version for 5+ years without updating?

How's that McAfee '05 doing for you?

NOT acceptable!!!

[syousef]

Totally my own damned fault for not staying upgraded.

Do you enjoy whipping yourself too???

You had working but out of date anti-virus. That's bad, but not as bad as no anti-virus at all, and arguably not as bad as disruption of your business and no functionality. Yet you choose to blame yourself? What about the schmuck who has an out of date piece of software that doesn't play nice with a later version? Providing free software does not mean you get to fuck with my business! What is the point of having antivirus software anyway? It is to prevent disruptions to your business by viruses? The trade off for slowing down your system with antivirus scanning is suppose to be reduced risk and disruption for your business.

It is your fault. Your fault not just for failing to update your antivirus, but for being so accepting of this from an antivirus company. Security types seem to have lost their mind and lost their ability to reason lately.

Re:NOT acceptable!!!

[jim_v2000]

HA HA HA.....an out of date antivirus IS as bad as no antivirus. Dear God, I hope you don't work doing this stuff.

Re:NOT acceptable!!!

[syousef]

HA HA HA.....an out of date antivirus IS as bad as no antivirus. Dear God, I hope you don't work doing this stuff.

An out of date antivirus doesn't protect you against new stuff but the old threats don't just disappear. Go look at the literature before lecturing me on what you hope I don't work doing. Idiot.

Re:NOT acceptable!!!

[jim_v2000]

It's the false sense of security that you get that makes up for the danger. Old threats are so rare that they may as well have disappeared.

Re:NOT acceptable!!!

[syousef]

Old threats are so rare that they may as well have disappeared.

Now that is an incredible display of ignorance. Old threats are routinely tracked and routinely only go away when the OS they infect or method of spread falls into disuse. If this is your idea of superior computer security expertise, you can keep it.

Re:NOT acceptable!!!

[jim_v2000]

LOL, my idea of computer security is keeping my tools up to date instead of getting pissed off about having to upgrade my antivirus.

Re:NOT acceptable!!!

[syousef]

LOL, my idea of computer security is keeping my tools up to date instead of getting pissed off about having to upgrade my antivirus.

No, you're idea is to allow your antivirus provider to install a kill switch on your system. I'm not arguing against upgrading or doing so in a timely manner, but when it comes to security being a sheep will get you eaten by wolves. That is exactly what you're doing.

Re:NOT acceptable!!!

[jim_v2000]

I'd rather come in one day and notice that my antivirus suddenly isn't working then never notice that the definitions are out of date. The former is much safer than the latter.

Re:Make Microsoft Products Illegal Already

[jim_v2000]

Where does Microsoft enter into a discussion about an open source antivirus running on Linux based servers?

ClamAV black eye

[dskoll]

I understand the ClamAV team's motivation, but hitting a kill switch on software that is only a year old is extremely rude. Had a proprietary vendor done it, /. posters would have been up in arms.

We have many customers running ClamAV. We managed to upgrade almost all of them before the kill switch, and the rest (the ones we were unable to contact) we got within hours after the kill switch.

However, I'm now being forced into the ironic position of having to recommend non-open-source software over open-source software. Here's why: Some of our clients specify that we're not allowed to provide software with a built-in "kill switch". We know ClamAV has such a switch, so we may be disqualified from using it. (Sure, proprietary software may have a similar switch, but we don't know for a fact it does... unlike ClamAV.)

All in all, Sourcefire handled this very badly, IMO. They could have done it much more gracefully.

Re:Shows how out of touch

[dnaumov]

I assume, then, that I can look at any vulnerability for the past three years and be confident of exploiting it on your systems, because you won't have upgraded past that.

Support. This word doesn't mean what you think it means.

Re:It's not like they didn't tell...

[natehoy]

True, though the only communications medium open to them (throwing exceptions to syslog) is obviously ignored by many ClamAV users. Those who were paying attention went to the URL and did the upgrade.

Those who did not were about to get a nonfunctional copy of Clam (no more updates, and AV is worse than useless without recent updates - it gives you a false sense of security which is far more dangerous than a real sense of fear). So you might as well kill it off with some fanfare so people who don't monitor their syslogs notice something is wrong.

yum subscribe-announce clamav

[bill_mcgonigle]

There was plenty of notice -- The fact that many of us weren't on the clamav-announce list is OUR fault, not theirs.

It would be nice if package managers integrated this for the sysadmin. Maybe the output of chkconfig could be consulted.

Ignorant rant above

[dbIII]

You've entirely missed that having decent rules to deal with attachments solves 99% of the virus problem. These days email server antivirus scans are to catch a virus hidden inside a zip file. If it's a directly executable attachment it should be blocked to save MS Outlook users from it, and of course the scanners look at the file type instead of trusting what the file name says it is.
On a web proxy it would be a far bigger deal but most web traffic isn't virus scanned yet.
Back to addressing the rant, as others have said clamav has the error message "LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***", along with a few other lines.
As for the open/closed argument I had a very similar problem with a commercial antivirus program that made a lot of changes which stopped it running on my mail server - that's why I started running clamav in the first place to cover the gap. Now I run both.

Re:Well, YOU had 6 months...

[SunFireSpaz]

If you had joined their announce mailing list and you would have know about this issue 4 times over the last six months.

late night call from tier 2

[dartmongrel]

Once recently I had to call a guy in noc to tell him all our people were getting warnings from Thunderbird that an email about to be sent contained a virus attached in a pdf. When he looked into it, (he had just gotten home to his terminal as he talked to me on his mobile) he started doing stuff. He started getting me to test mail.example1.com, then mail.example2.com ...etc. the three servers that handle mail in out company. In the end, he just said 'fuck it' and disabled it completely.

DanGuardian also hit

[ADenyer]

This can also cause DansGuardian to break if you use ClamAV on your web proxy. As others have said, for Debian, etc. the fix is in the volatile repos. Ubuntu 8.04 LTS on the other hand...
To be fair, the ClamAV authors have been pushing the upgrade for months...
--
Ubuntu: An African word meaning "Crippled Debian".

Re:It's not like they didn't tell...

[Culture20]

no more updates for 0.94 means 0.94 effectively does not work.

No, if someone sent me an email containing an old virus, it would still protect against that using the last updates it ever got. When they sent the kill switch, they did one of two things: prevented email from working (apparently a default setting for a lot of those affected), or allowed all viruses through (clamav no worky, but email chugs away). While option 1 is safer than allowing clamav to run, option 2 is decidedly less safe.

Re:Shows how out of touch

[Culture20]

So if the vendor promised to you that they'd continue to support a 6-month-old buggy version that was incapable of downloading new virus signatures, you'd be glad to run that version for 5+ years without updating?

How's that McAfee '05 doing for you?

I haven't gotten a file flagged as infected in years!
--
Buy Viagra Cheap!
Zeus, for all your botnet needs.

Signature size limit

[DrYak]

Read the story.

TFA is unclear.
Just go to the primary source (and note that the warning dates back from october 2009)

They didn't just disable new updates. They disabled the Antivirus engine altogether.

There isn't such a thing as the ability to remotely disable the engine. There's no such thing as a built-in remote kill switch.

Simply : Up to .94, ClamAv can't have signature much longer that 900-something bytes long in incremental update.
Up until now, they haven't needed such long and complex signature yet.
But now they need to be able to ship such signatures (they enable more complex detection algorithms).
Thus 2010-04-15's update contains a longer signature.

If you don't update the signatures and use an older file or pull the whole signature file instead of the incremental backup, the outdated ClamAV will still work.
If you update, the signatures will cause ClamAv to output an error message.

That's all of it.

Given that :
- .94 is two generation old (current is not .95, but .96)
- that the warnings are dating back from october (ample time for admins to react)
- that they always insist (and even display warning messages from clamav it self) that the best protection is to always use the latest clamav version
- they need the ability to do longer than-900 signature soon, it's important for complex detections.
- non-incremental updates are not an option due to the excessive stress they would put onto the mirror server ...their action doesn't seem illogical.

The alternative would be to keep refraining from using the long signatures, although they are needed for complex detections. On the grounds that there are still a couple of admins still using .94 despite all of the above.

Or start distributing long signature in full signature files and kill their mirror servers.

From a Sourcefire employee

[sudosudont]

I work at Sourcefire (however I do not work directly with ClamAV) and I believe their action is justified. Why should Sourcefire have to lend its name to an inferior product that is superseded by a year of development efforts?

Re:Shows how out of touch

[david_thornley]

Sure, support means what I think it does. It means answering questions, providing bugfixes, updating information, and when necessary providing upgrades.

In this case, ClamAV may well have made a mistake. The options were to hush it up or to admit it. If you deal with a vendor that has never admitted making a bad decision early in a project, you may want to wonder why that is.