Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.48k stars 708 forks source link

freshclam clobbers existing valid signature files if it can't connect to the mirror #1407

Open martinnehg opened 1 week ago

martinnehg commented 1 week ago

Describe the bug

If freshclam cannot connect to a mirror to download virus signatures, it will first overwrite and clobber any existing any valid signature files and exit. freshclam should check first whether to the mirror before altering the existing signature files.

How to reproduce the problem

freshclam # download virus signatures
# disable internet
freshclam # clobbers existing virus signatures
clamd # observe failure to start due to "Malformed database" error

Attachments

N/A

micahsnyder commented 1 week ago

Do you have any additional 3rd party signatures or just the standard daily, main, and bytecode signature files?

micahsnyder commented 1 week ago

I could not reproduce this issue. Are you able to consistently reproduce it?

Please share the output of clamconf -n as well. it will tell us your version, what additional signature databases you're using, and any other unusual configuration options that may be required to reproduce this issue.