amavisd-new fails to block viruses with backup scanner (clamscan)

[Imre Gergely]

Binary package hint: amavisd-new

When all primary scanners fail (specifically I was testing clamav), amavis tries to run some predefined backup scanners (in my case it is clamscan). There is a config file in /etc/amavis/conf.d named 15-av_scanners, which has all the primary and backup scanner definitions.

After trying out clamd with a test virus email (which got detected ok), I disabled clamd, so amavis would switch to clamscan, then I sent the same test mail (2 attachments, one with EICAR test signature and one clean file). Amavis failed to block the email with the following error:

May 16 10:41:01 utest-kk amavis[32558]: (32558-02) (!!)run_av (ClamAV-clamscan) FAILED - unexpected exit 1, output="/var/lib/amavis/tmp/amavis-20090516T103501-32558/parts/p001: OK\n/var/lib/amavis/tmp/amavis-20090516T103501-32558/parts/p005: Eicar-Test-Signature FOUND\n/var/lib/amavis/tmp/amavis-20090516T103501-32558/parts/p002: OK"

Notice the 'unexpected exit 1' message, which is the return code for clamscan when it FINDS a virus. The only problem is, amavisd doesn't get that because (IMHO) the faulty regexp in the config which does not match on the above clamscan output.

   ['ClamAV-clamscan', 'clamscan',
    "--stdout --no-summary -r --tempdir=$TEMPBASE {}",
    [0], qr/:.*\sFOUND$/, qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],

[0] - is the expected return code when NO viruses are found
qr/:.*\sFOUND$/ - this should match when viruses ARE found, but it doesn't, so amavis gets confused by the exit code

Amavis only finds the virus if the _last_ part/attachment of the email is infected, like this:

May 16 10:39:20 utest-kk amavis[32559]: (32559-01) run_av: /usr/bin/clamscan exit 1, /var/lib/amavis/tmp/amavis-20090516T103918-32559/parts/p003: OK\n/var/lib/amavis/tmp/amavis-20090516T103918-32559/parts/p001: OK\n/var/lib/amavis/tmp/amavis-20090516T103918-32559/parts/p005: Eicar-Test-Signature FOUND

Notice the order in which the email 'parts' are scanned (p005 is the last one and the above regexp matches).

This got fixed upstream in amavis 2.6.3 (amavisd.conf in the tarball) but I only found something in the changelog (no reference to a bug):

"- added missing /m flags to regular expressions in AV entries
  (a bug is revealed with Perl 5.10.0; previous versions of Perl happened
  to work, unintentionally accepting a /m flag if added late during a regexp
  evaluation); reported by Rafael;"

But the Debian package in testing (2.6.2-2) still has the older 15-av_scanners config file which isn't fixed. There is a closed Debian bug http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518524 however, which resembles this problem, but I think it's not the same.
Debian changelog of 2.6.3-1 doesn't mention changes to av_scanner config either.

Note: on default postfix+amavis content scanner, the infected mail remains in the mail queue with a 450 temporary error code.

This also affects Jaunty (2.6.2-2ubuntu2) and Intrepid (2.6.1.dfsg-2ubuntu1.1).
It doesn't seem to affect Hardy (2.5.3-1ubuntu3) or Dapper (2.3.3-3).

TEST CASE:
- install postfix + clamav + amavisd-new (content scanner to postfix)
- install spamassassin on Karmic (see Debian bug http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526529)
- configure amavisd as follows (in /etc/amavis/conf.d)
  - 15-av_scanners: disable clamd scanner, and make sure clamscan is enabled (in av_scanners_backup)
  - 15-content_filter_mode: enabled virus scanning (and spam scanning on Karmic)
  - 50-user: set $myhostname
- send a test email with multiple attachments, one of them the EICAR test virus (from http://www.eicar.org/anti_virus_test_file.htm)
- see it fail in the mail.log with above error message

[Imre Gergely (cemc)]

Talked to Debian package maintainer and he gave me an updated 15-av_scanners file for testing, and if all goes well, we can merge the new unstable package from Debian.

http://people.debian.org/~formorer/15-av_scanners

I'll update the report after testing.

[Scott Kitterman (kitterman)]

Thanks for the report. Although this is an important functional issue, it's not a security issue. I'm going to unmark this as a private/security bug.

[Thierry Carrez (ttx)]

> This got fixed upstream in amavis 2.6.3
We now have 2.6.4 for karmic, could you confirm that this is now fixed ?

[Simon Déziel (sdeziel)]

I have tested with the version included in Karmic and it's fixed.

[Imre Gergely (cemc)]

Confirmed it's working ok with my testcase on Karmic.

[Imre Gergely (cemc)]

This also affects Jaunty and Intrepid, maybe it should be fixed there also. One could argue that the following could be a real scenario:

- one installs MTA + amavis + clamav (with clamav-daemon because it's faster, and clamscan because it can be run manually whenever needed)
- primary AV scanner thus would be clamav-daemon and secondary would be clamscan (with the bug)
- clamav-daemon could go down for any number of reasons, and for the infected emails to not get through the backup AV should kick in and catch them.

[Scott Kitterman (kitterman)]

I set up a task for Jaunty. I think that's worth doing. I doubt Intrepid still has enough use to make it worth the trouble (if anyone needs this fixed on Intrepid, speak up).

[Imre Gergely (cemc)]

I think this bug can be closed as Jaunty is EOL and in Karmic it got fixed.