Bug 453601

Summary:	clamv should be upgraded from 0.92.1 to upstream 0.93.1
Product:	[Fedora] Fedora	Reporter:	Patrick Monnerat <patrick>
Component:	clamav	Assignee:	Enrico Scholz <rh-bugzilla>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	low
Version:	8	CC:	bressers, steve
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	0.92.1-3.fc8	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-07-17 14:17:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Patrick Monnerat 2008-07-01 14:42:34 UTC

Description of problem:
Since current F8 clamav version is 0.92.1 and upstream advertised version is
0.93.1, virus database mirrors allow only up to 6 update requests per day.
As a result, the database is not reliable when 6 update requests times the
mirror count is exceeded.

Version-Release number of selected component (if applicable):
0.92.1-2

How reproducible:
Always from now on

Steps to Reproduce:
1. As root, issue the "freshclam" command several times, until the text shown
below appears in /var/log/freshclam.log
  
Actual results:
Virus database is not updated until next day.
/var/log/freshclam.log shows (excerpts):
--------------------------------------
ClamAV update process started at Tue Jul  1 16:15:58 2008
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.92.1 Recommended version: 0.93.1
DON'T PANIC! Read http://www.clamav.net/support/faq
main.inc is up to date (version: 47, sigs: 312304, f-level: 31, builder: sven)
Ignoring mirror 212.71.0.71 (has connected too many times with an outdated version)
Ignoring mirror 130.59.10.36 (has connected too many times with an outdated version)
ERROR: getpatch: Can't download daily-7601.cdiff from database.clamav.net
Ignoring mirror 212.71.0.71 (has connected too many times with an outdated version)
Ignoring mirror 130.59.10.36 (has connected too many times with an outdated version)
ERROR: getpatch: Can't download daily-7601.cdiff from database.clamav.net
Ignoring mirror 130.59.10.36 (has connected too many times with an outdated version)
Ignoring mirror 212.71.0.71 (has connected too many times with an outdated version)
ERROR: getpatch: Can't download daily-7601.cdiff from database.clamav.net
WARNING: Incremental update failed, trying to download daily.cvd
Ignoring mirror 212.71.0.71 (has connected too many times with an outdated version)
Ignoring mirror 130.59.10.36 (has connected too many times with an outdated version)
ERROR: Can't download daily.cvd from database.clamav.net
Trying again in 5 secs...
ClamAV update process started at Tue Jul  1 16:16:03 2008
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.92.1 Recommended version: 0.93.1
DON'T PANIC! Read http://www.clamav.net/support/faq
main.inc is up to date (version: 47, sigs: 312304, f-level: 31, builder: sven)
Ignoring mirror 130.59.10.36 (has connected too many times with an outdated version)
Ignoring mirror 212.71.0.71 (has connected too many times with an outdated version)
ERROR: getpatch: Can't download daily-7601.cdiff from database.clamav.net
.
.
.
WARNING: Incremental update failed, trying to download daily.cvd
Ignoring mirror 212.71.0.71 (has connected too many times with an outdated version)
Ignoring mirror 130.59.10.36 (has connected too many times with an outdated version)
ERROR: Can't download daily.cvd from database.clamav.net
Giving up on database.clamav.net...
Update failed. Your network may be down or none of the mirrors listed in
freshclam.conf is working. Check http://www.clamav.net/support/mirror-problem
for possible reasons.
-------------------

Expected results:
Successful virus database update

Additional info:
Follow the link http://www.clamav.net/support/mirror-problem and search
paragraph "too often connections with outdated version" for and explanation by
clamav people.

Please note this is a security issue in an exploitation environment

Comment 1 John Poelstra 2008-07-01 16:24:15 UTC

triaged

Comment 2 Enrico Scholz 2008-07-01 19:05:56 UTC

I will try to patch freshclam to submit a faked version number; upgrade to
0.93.1 is impossible due to configuration file changes breaking existing
installations

Comment 3 Fedora Update System 2008-07-13 19:48:31 UTC

clamav-0.92.1-3.fc8 has been submitted as an update for Fedora 8

Comment 4 Fedora Update System 2008-07-15 12:20:45 UTC

clamav-0.92.1-3.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update clamav'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA-2008-6422

Comment 5 Patrick Monnerat 2008-07-16 12:30:51 UTC

Yum command above says:
Could not find update match for clamav
No package marked for update

I repeated the above command after a "yum --enablerepo=updates-testing clean 
all", with the same result.

Current installed version is clamav-0.92.1-2.fc8

Comment 6 Fedora Update System 2008-07-17 14:16:58 UTC

clamav-0.92.1-3.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.