clam error when special pdf as attachment

Forum for getting help with Project Gamera, Spamassassin, Clamav, qmail-scanner and other anti-spam tools.
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

clam error when special pdf as attachment

Unread post by BruceLee »

HI,

today received this error from clamav:
/var/log/messages:

Code: Select all

Oct 30 14:18:00 www clamd[526]: /var/spool/qscan/tmp/www.domain.tld12884409347902596/nttdocomo.zip: Unknown error code ERROR
/var/log/pas/maillog:

Code: Select all

Oct 30 14:14:34 www X-Qmail-Scanner-2.08st: [www.domain.tld12884409347902596] clamdscan: corrupt or unknown clamd scanner error or memory/resource/perms problem - exit status 512/2
attached was this pdf
http://www.nttdocomo.co.jp/corporate/ir ... /vol41.pdf

What can be done to prevent this or what is the exact error? Maybe the japanese characters?

thanks for any help
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: clam error when special pdf as attachment

Unread post by mikeshinn »

Hmmm, that is weird... looks like a bug in clamav 0.96.3 as I can reproduce this on Fedoras, Redhats and Centos 93 builds but not on 96.2 builds. So its something core in clamav thats not liking this PDF that was introduced between 96.2 and 96.3.

We'll look into a fix ASAP. I think I know what was changed upstream that may be causing this.
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: clam error when special pdf as attachment

Unread post by BruceLee »

Thanks a lot for the quick reply. Good to know that it's a bug, I wa a little bit confused why this happens.
Let me know if I can help in some way.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: clam error when special pdf as attachment

Unread post by mikeshinn »

I've got what I need, and thank you for including the file.
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: clam error when special pdf as attachment

Unread post by BruceLee »

You are welcome and I have to thank you. I totally agree with biggles statement (in the other post) and I can only praise yours and Scotts work. I'm very happy to be customer of yours and never regret my subscription. I wish I could contibute more.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: clam error when special pdf as attachment

Unread post by mikeshinn »

Thank you very much for the compliment, it really means a lot to know we're doing a good job and are keeping you a happy customer. :-)

As always, if there is anything we can do to help you or anything you'd like to see in our products (or maybe a product we hadn't though of) please let us know.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: clam error when special pdf as attachment

Unread post by mikeshinn »

Found the buggy code, working on a fix. Looks like its also been found upstream. Should have an update available soon.
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: clam error when special pdf as attachment

Unread post by BruceLee »

It's great to make compliments to people that deserve it like you do.
And I like people to know that they do a very good job and that I'm thankful.
Thank you very much for working on this issue that quick.
breun
Long Time Forum Regular
Long Time Forum Regular
Posts: 2813
Joined: Sat Aug 20, 2005 9:30 am
Location: The Netherlands

Re: clam error when special pdf as attachment

Unread post by breun »

Do you have some more details on this problem? Is it smart to not install 0.93-1 and wait for an update which fixes this problem? Or is it a pretty rare condition which triggers this problem and are we better off running 0.93 instead of staying on 0.92 for a bit?
Lemonbit Internet Dedicated Server Management
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: clam error when special pdf as attachment

Unread post by BruceLee »

In my opinion I would wait until Mike has an update unless you have a really good reason not to wait.
I don't know how rare this case is. I have installed the update on friday night and experienced this error one day later.
But this could be coincedence. My server is not high loaded since I handle a few customers.
Mike could tell you if this case is rare based on the fact that he knows what is causing this error.
I will stay with this version and wait for the update.
And I will keep you up2date if I get more of these cases.
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: clam error when special pdf as attachment

Unread post by mikeshinn »

0.96.4 is out now in the asl-2.0 channel which fixes this bug.

[tester0@qa2 ~]$ clamscan -V
ClamAV 0.96.3/12191/Sat Oct 30 19:25:54 2010
[tester0@qa2 ~]$ clamscan vol41.pdf
vol41.pdf: Unknown error code ERROR

[tester0@qa2 ~]$ clamscan -V
ClamAV 0.96.4/12191/Sat Oct 30 19:25:54 2010
[tester0@qa2 ~]$ clamscan vol41.pdf
vol41.pdf: OK
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: clam error when special pdf as attachment

Unread post by mikeshinn »

Do you have some more details on this problem? Is it smart to not install 0.93-1 and wait for an update which fixes this problem? Or is it a pretty rare condition which triggers this problem and are we better off running 0.93 instead of staying on 0.92 for a bit?
It was a very rare case, so most folks would probably not see it happen IMHO. Regardless, 0.96.4 is out and we recommend you upgrade. That fixes the bug, and includes other bug fixes and improvements.
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: clam error when special pdf as attachment

Unread post by BruceLee »

installed the updates and resend an email with this attachment for testing purposes.
works like a charme.
thanks Mike for the great and quick fix.
Enjoy the rest of your holi-half-day
Post Reply