search

Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.41k stars 705 forks source link

No warnings about outdated ClamAV version #1336

Open dmitrydonskih opened 2 months ago

dmitrydonskih commented 2 months ago

Describe the bug

There used to be warnings in logs about outdated ClamAV version. Now they do not appear. Also, a command defined in OnOutdatedExecute is not firing. I am running ClamAV 1.3.0 on Oracle Linux 9.4.

How to reproduce the problem

Download and install RPM https://www.clamav.net/downloads/production/clamav-1.3.0.linux.x86_64.rpm. Add OnOutdatedExecute=/my/script.sh to /etc/freshclam.conf. Check version: /usr/local/bin/freshclam -vvv --foreground=true --config-file=/etc/freshclam.conf --version

clamav-1.3.0-1.x86_64

Run /usr/local/bin/freshclam -vvv --foreground=true --config-file=/etc/freshclam.conf See output (note Software version from DNS: 0.103.11):

Thu Aug 15 23:32:51 2024 -> Current working dir is /var/lib/clamav/
Thu Aug 15 23:32:51 2024 -> Loaded freshclam.dat:
Thu Aug 15 23:32:51 2024 ->   version:    1
Thu Aug 15 23:32:51 2024 ->   uuid:       45ff9ef7-af95-4bd5-b5d2-791a6f5f70eb
Thu Aug 15 23:32:51 2024 -> ClamAV update process started at Thu Aug 15 23:32:51 2024
Thu Aug 15 23:32:51 2024 -> Current working dir is /var/lib/clamav/
Thu Aug 15 23:32:51 2024 -> Querying current.cvd.clamav.net
Thu Aug 15 23:32:51 2024 -> TTL: 1799
Thu Aug 15 23:32:51 2024 -> fc_dns_query_update_info: Software version from DNS: 0.103.11
Thu Aug 15 23:32:51 2024 -> Current working dir is /var/lib/clamav/
Thu Aug 15 23:32:51 2024 -> check_for_new_database_version: Local copy of daily found: daily.cld.
Thu Aug 15 23:32:51 2024 -> query_remote_database_version: daily.cvd version from DNS: 27368
Thu Aug 15 23:32:51 2024 -> daily.cld database is up-to-date (version: 27368, sigs: 2065627, f-level: 90, builder: raynman)
Thu Aug 15 23:32:51 2024 -> fc_update_database: daily.cld already up-to-date.
Thu Aug 15 23:32:51 2024 -> Current working dir is /var/lib/clamav/
Thu Aug 15 23:32:51 2024 -> check_for_new_database_version: Local copy of main found: main.cvd.
Thu Aug 15 23:32:51 2024 -> query_remote_database_version: main.cvd version from DNS: 62
Thu Aug 15 23:32:51 2024 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Thu Aug 15 23:32:51 2024 -> fc_update_database: main.cvd already up-to-date.
Thu Aug 15 23:32:51 2024 -> Current working dir is /var/lib/clamav/
Thu Aug 15 23:32:51 2024 -> check_for_new_database_version: Local copy of bytecode found: bytecode.cld.
Thu Aug 15 23:32:51 2024 -> query_remote_database_version: bytecode.cvd version from DNS: 335
Thu Aug 15 23:32:51 2024 -> bytecode.cld database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman)
Thu Aug 15 23:32:51 2024 -> fc_update_database: bytecode.cld already up-to-date.

/usr/local/bin/clamconf -n -c /etc/clamd.d/amavisd.conf

Checking configuration files in /etc/clamd.d/amavisd.conf

clamd.conf not found

freshclam.conf not found

clamav-milter.conf not found

Software settings
-----------------
Version: 1.3.0
Optional features supported: MEMPOOL AUTOIT_EA06 BZIP2 LIBXML2 PCRE2 ICONV JSON RAR

Database information
--------------------
Database directory: /usr/local/share/clamav
WARNING: freshclam.conf and clamd.conf point to different database directories
print_dbs: Can't open directory /usr/local/share/clamav

Platform information
--------------------
uname: Linux 5.15.0-206.153.7.1.el9uek.x86_64 #2 SMP Wed May 22 20:24:12 PDT 2024 x86_64
OS: Linux, ARCH: x86_64, CPU: x86_64
zlib version: 1.3.1 (1.3.1), compile flags: a9
platform id: 0x0a21c8c80800000000040805

Build information
-----------------
GNU C: 4.8.5 20150623 (Red Hat 4.8.5-44) (4.8.5)
sizeof(void*) = 8
Engine flevel: 200, dconf: 200

Attachments

None.

micahsnyder commented 2 months ago

Thanks for the report.

At present we can only check for a single "latest version" Since our change to our EOL policy and introducing an LTS version, we don't want folks on an older (but still supported) LTS release to see warnings that they need to upgrade.

So right now, we have the latest version set to "0.103.11". This warns folks that they must upgrade if their version is older than this. Sadly, it doesn't do anything for people on newer versions.

This is something I want to work on as well. We really need a way to define what are the latest patch versions of the currently supported releases, and then logic in Freshclam to check if the current version is outdated.