forked from Cisco-Talos/clamav
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathREADME
2717 lines (2097 loc) · 101 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Note: This README/NEWS file refers to the source tarball. Some things described
here may not be available in binary packages.
--
0.99.3
------
Welcome to ClamAV 0.99.3. In this release, we have included many code
submissions from the ClamAV community:
- Interfaces to the Prelude SIEM open source package for collecting
ClamAV virus events.
- Visual Studio 2015 for building Microsoft Windows binaries.
- Support libmspack internal code or as a shared object library.
The internal library is the default and contains additional
integrity checks.
- Linking with openssl 1.1.0.
- Numerous code patches, typos, and compiler warning fixes.
Additionally, we have introduced important changes and new features in
ClamAV 0.99.3, including:
- Deprecating internal LLVM code support. The configure script has changed
to search the system for an installed instance of the LLVM development
libraries, and to otherwise use the bytecode interpreter for ClamAV
bytecode signatures. To use the LLVM Just-In-Time compiler for
executing bytecode signatures, please ensure that the LLVM development
package at version 3.6 or lower is installed. Using the deprecated LLVM
code is possible with the command: './configure --with-system-llvm=no',
but it no longer compiles on all platforms.
- Compute and check PE import table hash (a.k.a. "imphash") signatures.
- Support file property collection and analysis for MHTML files.
- Raw scanning of PostScript files.
- Fix clamsubmit to use the new virus and false positive submission web
interface.
- Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when
size limitations are exceeded.
- Improve decoders for PDF files.
The ClamAV community thanks the following individuals for their ClamAV 0.99.3
code submissions:
Sebastian Andrzej Siewior
Keith Jones
Bill Parker
Chris Miserva
Daniel J. Luke
Matthew Boedicker
Ningirsu
Michael Pelletier
Anthony Chan
Stephen Welker
Marc Deslauriers
Mark Allan
Andreas Schulze
Jonas Zaddach
0.99.2
------
ClamAV 0.99.2 is a release of bug fixes and minor enhancements.
- fix ups improving the reliability of several ClamAV file parsers.
- sigtool now decodes file type signatures (e.g., daily.ftm CVD file).
- now supporting libpcre2 in addition to libpcre.
- systemd support for clamd and freshclam. Patch provided by
Andreas Cadhalpun.
- fixed builds on Mac OS X 10.10 & 10.11.
- improved debug info for certificate metadata.
- improved freshclam messaging when using a proxy.
- fixed some freshclam functionality when using private mirrors.
- clamd refinements of open file limitations on Solaris. Patch by
Jim Morris
- clamav-milter signal handling for improved clean up during
termination.
Thank you to the following ClamAV community members for your code
submissions and bug reports!
Brandon Perry
Sebastian Andrzej Siewior
Andreas Cadhalpun
Jim Morris
Kai Risku
Bill Parker
Tomasz Kojm
Steve Basford
Daniel J. Luke
James Ralston
John Dodson
0.99.1
------
ClamAV 0.99.1 contains a new feature for parsing Hancom Office files
including extracting and scanning embedded objects. ClamAV 0.99.1
also contains important bug fixes. Please see ChangeLog for details.
Thanks to the following community members for code submissions used in
ClamAV 0.99.1:
Jim Morris
Andreas Cadhalpun
Mark Allan
Sebastian Siewior
0.99
----
ClamAV 0.99 contains major new features and changes. YARA rules,
Perl Compatible Regular Expressions, revamped on-access scanning
for Linux, and other new features join the many great features of ClamAV:
- Processing of YARA rules(some limitations- see signatures.pdf).
- Support in ClamAV logical signatures for many of the features
added for YARA, such as Perl Compatible Regular Expressions,
alternate strings, and YARA string attributes. See signatures.pdf
for full details.
- New and improved on-access scanning for Linux. See the recent blog
post and clamdoc.pdf for details on the new on-access capabilities.
- A new ClamAV API callback function that is invoked when a virus
is found. This is intended primarily for applications running in
all-match mode. Any applications using all-match mode must use
the new callback function to record and report detected viruses.
- Configurable default password list to attempt zip file decryption.
- TIFF file support.
- Upgrade Windows pthread library to 2.9.1.
- A new signature target type for designating signatures to run
against files with unknown file types.
- Improved fidelity of the "data loss prevention" heuristic
algorithm. Code supplied by Bill Parker.
- Support for LZMA decompression within Adobe Flash files.
- Support for MSO attachments within Microsoft Office 2003 XML files.
- A new sigtool option(--ascii-normalize) allowing signature authors
to more easily generate normalized versions of ascii files.
- Windows installation directories changed from \Program Files\Sourcefire\
ClamAV to \Program Files\ClamAV or \Program Files\ClamAV-x64.
PLEASE NOTE: If you are using clamd on-access scanning or have applications
using all-match mode, you will want to review the changes and make any necessary
adjustments before using ClamAV 0.99. Users of windows binaries need to be
aware of the change of installation directories.
Thank you to the ClamAV community members who sent patches and bug reports
included for ClamAV 0.99:
Steve Basford
Sebastian Andrzej Siewior
Bill Parker
Andreas Schulze
Yann E. Morin
Andreas Cadhalpun
Dmitry Marakasov
Michael Pelletier
Felix Groebert
Stephen Welker
0.98.7
------
ClamAV 0.98.7 is here! This release contains new scanning features
and bug fixes.
- Improvements to PDF processing: decryption, escape sequence
handling, and file property collection.
- Scanning/analysis of additional Microsoft Office 2003 XML format.
- Fix infinite loop condition on crafted y0da cryptor file. Identified
and patch suggested by Sebastian Andrzej Siewior. CVE-2015-2221.
- Fix crash on crafted petite packed file. Reported and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2222.
- Fix false negatives on files within iso9660 containers. This issue
was reported by Minzhuan Gong.
- Fix a couple crashes on crafted upack packed file. Identified and
patches supplied by Sebastian Andrzej Siewior.
- Fix a crash during algorithmic detection on crafted PE file.
Identified and patch supplied by Sebastian Andrzej Siewior.
- Fix an infinite loop condition on a crafted "xz" archive file.
This was reported by Dimitri Kirchner and Goulven Guiheux.
CVE-2015-2668.
- Fix compilation error after ./configure --disable-pthreads.
Reported and fix suggested by John E. Krokes.
- Apply upstream patch for possible heap overflow in Henry Spencer's
regex library. CVE-2015-2305.
- Fix crash in upx decoder with crafted file. Discovered and patch
supplied by Sebastian Andrzej Siewior. CVE-2015-2170.
- Fix segfault scanning certain HTML files. Reported with sample by
Kai Risku.
- Improve detections within xar/pkg files.
As always, we appreciate contributions of bug reports, code fixes,
and sample submission from the ClamAV community members:
Sebastian Andrzej Siewior
Minzhaun Gong
Dimitri Kirchner
Goulven Guiheux
John E. Krokes
Kai Risku
0.98.6
------
ClamAV 0.98.6 is a bug fix release correcting the following:
- library shared object revisions.
- installation issues on some Mac OS X and FreeBSD platforms.
- includes a patch from Sebastian Andrzej Siewior making
ClamAV pid files compatible with systemd.
- Fix a heap out of bounds condition with crafted Yoda's
crypter files. This issue was discovered by Felix Groebert
of the Google Security Team.
- Fix a heap out of bounds condition with crafted mew packer
files. This issue was discovered by Felix Groebert of the
Google Security Team.
- Fix a heap out of bounds condition with crafted upx packer
files. This issue was discovered by Kevin Szkudlapski of
Quarkslab.
- Fix a heap out of bounds condition with crafted upack packer
files. This issue was discovered by Sebastian Andrzej Siewior.
CVE-2014-9328.
- Compensate a crash due to incorrect compiler optimization when
handling crafted petite packer files. This issue was discovered
by Sebastian Andrzej Siewior.
Thanks to the following ClamAV community members for code submissions
and bug reporting included in ClamAV 0.98.6:
Sebastian Andrzej Siewior
Felix Groebert
Kevin Szkudlapski
Mark Pizzolato
Daniel J. Luke
0.98.5
------
Welcome to ClamAV 0.98.5! ClamAV 0.98.5 includes important new features
for collecting and analyzing file properties. Software developers and
analysts may collect file property meta data using the ClamAV API for
subsequent analysis by ClamAV bytecode programs. Using these features
will require that libjson-c is installed, but otherwise libjson-c is not
needed.
Look for our upcoming series of blog posts to learn more about using the
ClamAV API and bytecode facilities for collecting and analyzing file
properties.
ClamAV 0.98.5 also includes these new features and bug fixes:
- Support for the XDP file format and extracting, decoding, and
scanning PDF files within XDP files.
- Addition of shared library support for LLVM versions 3.1 - 3.5
for the purpose of just-in-time(JIT) compilation of ClamAV
bytecode signatures. Andreas Cadhalpun submitted the patch
implementing this support.
- Enhancements to the clambc command line utility to assist
ClamAV bytecode signature authors by providing introspection
into compiled bytecode programs.
- Resolution of many of the warning messages from ClamAV compilation.
- Improved detection of malicious PE files.
- Security fix for ClamAV crash when using 'clamscan -a'. This issue
was identified by Kurt Siefried of Red Hat.
- Security fix for ClamAV crash when scanning maliciously crafted
yoda's crypter files. This issue, as well as several other bugs
fixed in this release, were identified by Damien Millescamp of
Oppida.
- ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode.
Thanks to Reinhard Max for supplying the patch.
- Bug fixes and other feature enhancements. See Changelog or
git log for details.
Thanks to the following ClamAV community members for code submissions
and bug reporting included in ClamAV 0.98.5:
Andreas Cadhalpun
Sebastian Andrzej Siewior
Damien Millescamp
Reinhard Max
Kurt Seifried
0.98.4
------
ClamAV 0.98.4 is a bug fix release. The following issues are now resolved:
- Various build problems on Solaris, OpenBSD, AIX.
- Crashes of clamd on Windows and Mac OS X platforms when reloading
the virus signature database.
- Infinite loop in clamdscan when clamd is not running.
- Freshclam failure on Solaris 10.
- Buffer underruns when handling multi-part MIME email attachments.
- Configuration of OpenSSL on various platforms.
- Name collisions on Ubuntu 14.04, Debian sid, and Slackware 14.1.
Thanks to the following individuals for testing, writing patches, and
initiating quality improvements in this release:
Tuomo Soini
Scott Kitterman
Jim Klimov
Curtis Smith
Steve Basford
Martin Preen
Lars Hecking
Stuart Henderson
Ismail Paruk
Larry Rosenbaum
Dave Simonson
Sebastian Andrzej Siewior
0.98.2
------
Here are the new features and improvements in ClamAV 0.98.2:
- Support for common raw disk image formats using 512 byte sectors,
specifically GPT, APM, and MBR partitioning.
- Experimental support of OpenIOC files. ClamAV will now extract file
hashes from OpenIOC files residing in the signature database location,
and generate ClamAV hash signatures. ClamAV uses no other OpenIOC
features at this time. No OpenIOC files will be delivered through
freshclam. See openioc.org and iocbucket.com for additional information
about OpenIOC.
- All ClamAV sockets (clamd, freshclam, clamav-milter, clamdscan, clamdtop)
now support IPV6 addresses and configuration parameters.
- Use OpenSSL file hash functions for improved performance. OpenSSL
is now prerequisite software for ClamAV 0.98.2.
- Improved detection of malware scripts within image files. Issue reported
by Maarten Broekman.
- Change to circumvent possible denial of service when processing icons within
specially crafted PE files. Icon limits are now in place with corresponding
clamd and clamscan configuration parameters. This issue was reported by
Joxean Koret.
- Improvements to the fidelity of the ClamAV pattern matcher, an issue
reported by Christian Blichmann.
- Opt-in collection of statistics. Statistics collected are: sizes and MD5
hashes of files, PE file section counts and section MD5 hashes, and names
and counts of detected viruses. Enable statistics collection with the
--enable-stats clamscan flag or StatsEnabled clamd configuration
parameter.
- Improvements to ClamAV build process, unit tests, and platform support with
assistance and suggestions by Sebastian Andrzej Siewior, Scott Kitterman,
and Dave Simonson.
- Patch by Arkadiusz Miskiewicz to improve error handling in freshclam.
- ClamAV 0.98.2 also includes miscellaneous bug fixes and documentation
improvements.
Thanks to the following ClamAV community members for sending patches or reporting
bugs and issues that are addressed in ClamAV 0.98.2:
Sebastian Andrzej Siewior
Scott Kitterman
Joxean Koret
Arkadiusz Miskiewicz
Dave Simonson
Maarten Broekman
Christian Blichmann
--
REGARDING OPENSSL
In addition, as a special exception, the copyright holders give
permission to link the code of portions of this program with the
OpenSSL library under certain conditions as described in each
individual source file, and distribute linked combinations
including the two.
You must obey the GNU General Public License in all respects
for all of the code used other than OpenSSL. If you modify
file(s) with this exception, you may extend this exception to your
version of the file(s), but you are not obligated to do so. If you
do not wish to do so, delete this exception statement from your
version. If you delete this exception statement from all source
files in the program, then also delete it here.
0.98.1
------
ClamAV 0.98.1 provides improved support of Mac OS X platform, support for new file types, and
quality improvements. These include:
- Extraction, decompression, and scanning of files within Apple Disk Image (DMG) format.
- Extraction, decompression, and scanning of files within Extensible Archive (XAR) format.
XAR format is commonly used for software packaging, such as PKG and RPM, as well as
general archival.
- Decompression and scanning of files in "Xz" compression format.
- Recognition of Open Office XML formats.
- Improvements and fixes to extraction and scanning of ole formats.
- Option to force all scanned data to disk. This impacts only a few file types where
some embedded content is normally scanned in memory. Enabling this option
ensures that a file descriptor exists when callback functions are used, at a small
performance cost. This should only be needed when callback functions are used
that need file access.
- Various improvements to ClamAV configuration, support of third party libraries,
and unit tests.
0.98
------
ClamAV 0.98 includes many new features, across all the different components
of ClamAV. There are new scanning options, extensions to the libclamav API,
support for additional filetypes, and internal upgrades.
- Signature improvements: New signature targets have been added for
PDF files, Flash files and Java class files. (NOTE: Java archive files
(JAR) are not part of the Java target.) Hash signatures can now specify
a '*' (wildcard) size if the size is unknown. Using wildcard size
requires setting the minimum engine FLEVEL to avoid backwards
compatibility issues. For more details read the ClamAV Signatures
guide.
- Scanning enhancements: New filetypes can be unpacked and scanned,
including ISO9660, Flash, and self-extracting 7z files. PDF
handling is now more robust and better handles encrypted PDF files.
- Authenticode: ClamAV is now aware of the certificate chains when
scanning signed PE files. When the database contains signatures for
trusted root certificate authorities, the engine can whitelist
PE files with a valid signature. The same database file can also
include known compromised certificates to be rejected! This
feature can also be disabled in clamd.conf (DisableCertCheck) or
the command-line (nocerts).
- New options: Several new options for clamscan and clamd have been
added. For example, ClamAV can be set to print infected files and
error files, and suppress printing OK results. This can be helpful
when scanning large numbers of files. This new option is "-o" for
clamscan and "LogClean" for clamd. Check clamd.conf or the clamscan
help message for specific details.
- New callbacks added to the API: The libclamav API has additional hooks
for developers to use when wrapping ClamAV scanning. These function
types are prefixed with "clcb_" and allow developers to add logic at
certain steps of the scanning process without directly modifying the
library. For more details refer to the clamav.h file.
- More configurable limits: Several hardcoded values are now configurable
parameters, providing more options for tuning the engine to match your
needs. Check clamd.conf or the clamscan help message for specific
details.
- Performance improvements: This release furthers the use of memory maps
during scanning and unpacking, continuing the conversion started in
prior releases. Complex math functions have been switched from
libtommath to tomsfastmath functions. The A/C matcher code has also
been optimized to provide a speed boost.
- Support for on-access scanning using Clamuko/Dazuko has been replaced
with fanotify. Accordingly, clamd.conf settings related to on-access
scanning have had Clamuko removed from the name. Clamuko-specific
configuration items have been marked deprecated and should no longer
be used.
There are also fixes for other minor issues and code quality changes. Please
see the ChangeLog file for details.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.97.8
----
ClamAV 0.97.8 addresses several reported potential security bugs. Thanks to
Felix Groebert of the Google Security Team for finding and reporting these
issues.
0.97.7
----
ClamAV 0.97.7 addresses several reported potential security bugs. Thanks to
Felix Groebert, Mateusz Jurczyk and Gynvael Coldwind of the Google Security
Team for finding and reporting these issues.
0.97.6
----
ClamAV 0.97.6 includes minor bug fixes and detection improvements.
ClamAV 0.97.6 corrects bug 5252 "CL_EFORMAT: Bad format or broken data ERROR
reported as scan result."
0.97.5
------
ClamAV 0.97.5 addresses possible evasion cases in some archive formats
(CVE-2012-1457, CVE-2012-1458, CVE-2012-1459). It also addresses stability
issues in portions of the bytecode engine. This release is recommended for
all users.
0.97.4
------
ClamAV 0.97.4 includes minor bugfixes, detection improvements and initial
support for on-access scanning under Mac OS X (see contrib/ClamAuth).
This update is recommended for all users.
0.97.3
------
ClamAV 0.97.3 is a minor bugfix release and is recommended for all
users. Please refer to the ChangeLog file for details.
0.97.2
------
ClamAV 0.97.2 fixes problems with the bytecode engine, Safebrowsing detection,
hash matcher, and other minor issues. Please see the ChangeLog file for
details.
0.97.1
------
This is a bugfix release recommended for all users. Please refer to the
ChangeLog file for details.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.97
----
ClamAV 0.97 brings many improvements, including complete Windows support
(all major components compile out-of-box under Visual Studio), support for
signatures based on SHA1 and SHA256, better error detection, as well as
speed and memory optimizations. The complete list of changes is available
in the ChangeLog file. For upgrade notes and tips please see:
https://wiki.clamav.net/Main/UpgradeNotes097
With Sourcefire, Inc. acquisition of Immunet Corp., ClamAV for Windows
3.0 has been renamed Immunet 3.0, powered by ClamAV. This release
contains the fully integrated LibClamAV 0.97 engine for offline,
OnDemand, and OnAccess scanning. Immunet 3.0 users can now utilize
the full power of the LibClamAV engine, all the ClamAV signatures,
and creation of custom signatures on any platform running Immunet 3.0,
powered by ClamAV. If you run Windows systems in your environment and
need an AV solution to protect them, give Immunet 3.0, powered by ClamAV
a try; you can download it from http://www.clamav.net/download.html#otherversions
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.96.5
------
ClamAV 0.96.5 includes bugfixes and minor feature enhancements, such as
improved handling of detection statistics, better file logging,
and support for custom database URLs in freshclam. Please refer to the
ChangeLog for details.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.96.4
------
ClamAV 0.96.4 is a bugfix release recommended for all users.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.96.3
------
This release fixes problems with the PDF parser and the internal bzip2
library. A complete list of changes is available in the Changelog file.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.96.2
------
ClamAV 0.96.2 brings a new PDF parser, performance and memory improvements,
and a number of bugfixes and minor enhancements. This upgrade is recommended
for all users.
0.96.1
------
This is a bugfix release, please refer to the ChangeLog for the complete
list of changes.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.96
----
This release of ClamAV introduces new malware detection mechanisms and other
significant improvements to the scan engine. The key features include:
- The Bytecode Interpreter: the interpreter built into LibClamAV allows
the signature writers to create and distribute very complex detection
routines and remotely enhance the scanner's functionality
- Heuristic improvements: improve the PE heuristics detection engine by
adding support of bogus icons and fake PE header information. In a
nutshell, ClamAV can now detect malware that tries to disguise itself
as a harmless application by using the most common Windows program icons.
- Signature Improvements: logical signature improvements to allow more
detailed matching and referencing groups of signatures. Additionally,
improvements to wildcard matching on word boundaries and newlines.
- Support for new archives: 7zip, InstallShield and CPIO. LibClamAV
can now transparently unpack and inspect their contents.
- Support for new executable file formats: 64-bit ELF files and OS X
Universal Binaries with Mach-O files. Additionally, the PE module
can now decompress and inspect executables packed with UPX 3.0.
- Support for DazukoFS in clamd
- Performance improvements: overall performance improvements and memory
optimizations for a better overall resource utilization experience.
- Native Windows Support: ClamAV will now build natively under Visual
Studio. This will allow 3rd Party application developers on Windows
to easily integrate LibClamAV into their applications.
The complete list of changes is available in the ChangeLog file. For upgrade
notes and tips please see: https://wiki.clamav.net/Main/UpgradeNotes096
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.95.3
------
ClamAV 0.95.3 is a bugfix release recommended for all users.
Please refer to the ChangeLog included in the source distribution
for the list of changes.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.95.2
------
This version improves handling of archives, adds support for --file-list
in clamscan and clamdscan, and fixes various issues found in previous
releases.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.95.1
------
This is a bugfix release only, please see the ChangeLog for details.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.95
----
ClamAV 0.95 introduces many bugfixes, improvements and additions. To make
the transition easier, we put various tips and upgrade notes on this page:
https://wiki.clamav.net/Main/UpgradeNotes095. For detailed list of changes
and bugfixes, please see the ChangeLog.
The following are the key features of this release:
- Google Safe Browsing support: in addition to the heuristic and signature
based phishing detection mechanisms already available in ClamAV, the
scanner can now make use of the Google's blacklists of suspected
phishing and malware sites. The ClamAV Project distributes a constantly
updated Safe Browsing database, which can be automatically fetched by
freshclam. For more information, please see freshclam.conf(5) and
http://safebrowsing.clamav.net.
- New clamav-milter: The program has been redesigned and rewritten from
scratch. The most notable difference is that the internal mode has been
dropped which means that now a working clamd companion is required.
The milter now also has its own configuration file.
- Clamd extensions: The protocol has been extended to lighten the load
that clamd puts on the system, solve limitations of the old protocol,
and reduce latency when signature updates are received. For more
information about the new extensions please see the official
documentation and the upgrade notes.
- Improved API: The API used to program ClamAV's engine (libclamav) has
been redesigned to use modern object-oriented techniques and solves
various API/ABI compatibility issues between old and new releases.
You can find more information in Section 6 of clamdoc.pdf and in
the upgrade notes.
- ClamdTOP: This is a new program that allows system administrators to
monitor clamd. It provides information about the items in the clamd's
queue, clamd's memory usage, and the version of the signature database,
all in real-time and in nice curses-based interface.
- Memory Pool Allocator: Libclamav now includes its own memory pool
allocator based on memory mapping. This new solution replaces the
traditional malloc/free system for the copy of the signatures that
is kept in memory. As a result, clamd requires much less memory,
particularly when signature updates are received and the database is
loaded into memory.
- Unified Option Parser: Prior to version 0.95 each program in ClamAV's
suite of programs had its own set of runtime options. The new general
parser brings consistency of use and validation to these options across
the suite. Some command line switches of clamscan have been renamed
(the old ones will still be accepted but will have no effect and will
result in warnings), please see clamscan(1) and clamscan --help for
the details.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.94.2
------
This is a bugfix release, please refer to the ChangeLog for a complete
list of changes.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.94.1
------
ClamAV 0.94.1 fixes some issues that were found in previous releases and
includes one new feature, "Malware Statistics Gathering." This is an optional
feature that allows ClamAV users optionally to submit statistics to us about
what they detect in the field. We will then use these data to determine what
types of malware are the most detected in the field and in what geographic
area they are. It will also allow us to publish summary data on www.clamav.net
where our users will be able to monitor the latest threats. You can help us
by enabling SubmitDetectionStats in freshclam.conf.
For more details, please refer to the ChangeLog
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.94
----
Sourcefire and the ClamAV team are pleased to announce the release of
ClamAV 0.94. The following are the key features and improvements of this
version:
- Logical Signatures: The logical signature technology uses operators
such as AND, OR and NOT to allow the combination of more than one
signature into one entry in the signature database resulting in
more detailed and flexible pattern matching.
- Anti-phishing Technology: Users can now change the priority and reporting
of ClamAV's heuristic anti-phishing scanner within the detection engine
process. They can choose whether, when scanning a supicious file, ClamAV
should stop scanning and report the phish, or continue to scan in case the
file contains other malware (clamd: HeuristicScanPrecedence,
clamscan: --heuristic-scan-precedence)
- Disassembly Engine: The initial version of the disassembly engine improves
ClamAV's detection abilities.
- PUA Detection: Users can now decide which PUA signatures should be loaded
(clamd: ExcludePUA, IncludePUA; clamscan: --exclude-pua, --include-pua)
- Data Loss Prevention (DLP): This version includes a new module that, when
enabled, scans data for the inclusion of US formatted Social Security
Numbers and credit card numbers (clamd: StructuredDataDetection,
clamscan: --detect-structured; additional fine-tuning options are available)
- IPv6 Support: Freshclam now supports IPv6
- Improved Scanning of Scripts: The normalization of scripts now covers
JavaScript
- Improved QA and Unit Testing: The improved QA process now includes
API testing and new library of test files in various formats that are
tested on a wide variety of systems (try running 'make check' in the source
directory)
You may need to run 'ldconfig' after installing this version.
** This version drops the special support for Cygwin. Our QA process showed
** serious problems with ClamAV builds under Cygwin due to some low-level
** incompatibilities in the POSIX compatibility layer, resulting in unreliable
** ClamAV behaviour.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.93.3
------
This release fixes a problem in handling of .cld files introduced in 0.93.2.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.93.2
------
This release fixes and re-enables the Petite unpacker, improves database
loading and solves some other minor issues.
0.93.1
------
This version improves handling of PDF, CAB, RTF, OLE2 and HTML files
and includes various bugfixes for 0.93 issues.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.93
----
This release introduces many new features and engine enhancements, please
see the notes below for the list of major changes. The most visible one
is the new logic in scan limits which affects some command line and config
options of clamscan and clamd. Please see clamscan(1) and clamd.conf(5)
and the example config file for more information on the new options.
Most important changes include:
* libclamav:
- New logic in scan limits: provides much more efficient protection against
DoS attacks but also results in different command line and config options
to clamscan and clamd (see below)
- New/improved modules: unzip, SIS, cabinet, CHM, SZDD, text normalisator,
entity converter
- Improved filetype detection; filetype definitions can be remotely updated
- Support for .cld containers (which replace .inc directories)
- Improved pattern matcher and signature formats
- More efficient scanning of HTML files
- Many other improvements
* clamd:
- NEW CONFIG FILE OPTIONS: MaxScanSize, MaxFileSize, MaxRecursion, MaxFiles
- ** THE FOLLOWING OPTIONS ARE NO LONGER SUPPORTED **: MailMaxRecursion,
ArchiveMaxFileSize, ArchiveMaxRecursion, ArchiveMaxFiles,
ArchiveMaxCompressionRatio, ArchiveBlockMax
* clamscan:
- NEW CMDLINE OPTIONS: --max-filesize, --max-scansize
- REMOVED OPTIONS: --block-max, --max-space, --max-ratio
* freshclam:
- NEW CONFIG OPTION CompressLocalDatabase
- NEW CMDLINE SWITCH --no-warnings
- main.inc and daily.inc directories are no longer used by ClamAV; please
remove them manually from your database directory
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.92.1
------
This is a bugfix release, please refer to the ChangeLog for a complete
list of changes.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.92
----
This release provides various bugfixes, optimisations and improvements
to the scanning engine. The new features include support for ARJ and
SFX-ARJ archives, AutoIt, basic SPF parser in clamav-milter (to reduce
phishing false-positives), faster scanning and others (see ChangeLog).
To get a consistent behaviour of the anti-phishing module on all platforms,
libclamav now includes the regex library from OpenBSD.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.91.2
-------
This release fixes various bugs in libclamav, freshclam and clamav-milter,
and adds support for PUA (Potentially Unwanted Application) signatures
(clamscan: --detect-pua, clamd: DetectPUA).
** Announcement **
Dear ClamAV users,
On August 17, Sourcefire, the creators of Snort, acquired the ClamAV project.
The full announcement is available here:
http://www.sourcefire.com/products/clamav/
We'd like to thank everyone in the ClamAV community for their dedication to
the project. The acquisition by Sourcefire is a testament to the hard work of
the entire ClamAV community in developing cutting edge technology that truly
showcases the promise of the open source model. With the additional resources
Sourcefire will provide we look forward to working with the community to
continue the advancement of ClamAV.
Sourcefire now owns ClamAV project and related trademarks, as well as the
source code copyrights held by the five principal members of the ClamAV team.
Sourcefire will also assume control of the ClamAV project including: the
ClamAV.org domain, web site and web site content; and the ClamAV Sourceforge
project page.
What's most important is that from the end-user perspective very little will
change beyond the additional resources Sourcefire will provide in our
continued efforts to advance the ClamAV technology and improve our ability to
interact with the open source community. The core team will continue to lead
the advancement of ClamAV and the CVD as employees of Sourcefire. Both the
ClamAV engine and the signature database will remain under GPL.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.91.1
------
This release fixes stability and other issues of 0.91.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.91
----
ClamAV 0.91 is the first release to enable the anti-phishing technology
in default builds. This technology combines heuristics with special
signatures and provides effective protection against phishing threats.
Other important changes and add-ons in this version include:
- unpacker for NSIS (Nullsoft Scriptable Install System) self-extracting
archives
- unpacker for ASPack 2.12
- new implementation of the Aho-Corasick pattern matcher providing
better detection for wildcard enabled signatures
- support for nibble matching and floating offsets
- improved handling of .mdb files (fixes long startup times)
- extraction of PE files embedded into other executables
- better handling of PE & UPX
- removed dependency on libcurl (improves stability)
- libclamav.dll available under Windows
- IPv6 support in clamav-milter
- many other improvements and bugfixes
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.90.3
------
This release fixes some security bugs in libclamav and improves stability
under Solaris. Please see ChangeLog for complete list of changes.
If your system is suffering from long clamscan startup times, please
consider installing 0.91rc1 which is due to be released shortly
after 0.90.3.
--
The ClamAV team (http://www.clamav.net/about.html#credits)
0.90.2
------