René Berber wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Alex Moore wrote:
On Mon, 12 Mar 2007 15:01:06 +0200 (SAST)
"[EMAIL PROTECTED]" <[EMAIL PROTECTED]> wrote:
I am experiencing the same problems.
We have two quad CPU E450's running Solaris 9 handling the incomming
mail on our domains. These servers are generally very busy.
No experimental code here.
This is from Sébastien Cat. Send a .zip file through clamav 0.90.1
with ScanArchive enabled. I just did this and clamd crashed. I
disabled ScanArchive and restarted clamd. The email scanned without
crashing 0.90.1
This sure looks like the reason for the occasional clamd crash here! I
have had this option enabled for as long as I can remember and this is
the first time that clamd has crashed from a zipped file.
Can anyone confirm this on your Solaris installation?
No, quite the contrary, I tested a couple of zip files and they were handled
correctly, and with no problem, by clamd.
This is under Solaris 9 sparc, clamav compiled with gcc, ScanArchive enabled, no
experimental option. Clamd 0.90.1 has been running with no problem since I
installed it.
I've also had no problems with zip files but I don't scan all zip files.
I crawled my logs and found that certain filenames of zip files always
had viruses in them, and the same with certain zipfile filename
patterns. Files with a pattern of [EMAIL PROTECTED], for example,
were always found to contain viruses, so in my milter I block messages
that have those patterns. Over time that list has grown to 296 entries
including regex patterns, so the coverage is quite large in terms of all
the files that will be blocked without the expense of scanning. I'm
surprised that there's never been a user ticket generated as it's quite
aggressive.
dp
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
