<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">


<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Verdana;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:blue;
        text-decoration:underline;}
span.EmailStyle18
        {mso-style-type:personal-reply;
        font-family:Arial;
        color:navy;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=blue>

<div class=Section1>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Perhaps Julian can amend install-Clam-SA
to force a build and reinstall of Mail::ClamAV every time.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Little overhead, but worth it if this is
going to cause us problems again.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Cheers,<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Phil<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p>&nbsp;</o:p></span></font></p>

<div>

<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>

<hr size=2 width="100%" align=center tabindex=-1>

</span></font></div>

<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <b><span style='font-weight:
bold'>On Behalf Of </span></b>Way to the Web<br>
<b><span style='font-weight:bold'>Sent:</span></b> Saturday, December 16, 2006
3:49 PM<br>
<b><span style='font-weight:bold'>To:</span></b> MailScanner discussion<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: New ClamAV out</span></font><o:p></o:p></p>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>On 12/12/06, <b><span style='font-weight:bold'>Denis Beauchemin</span></b>
&lt;<a href="mailto:Denis.Beauchemin@usherbrooke.ca">Denis.Beauchemin@usherbrooke.ca</a>&gt;
wrote:<o:p></o:p></span></font></p>

<div>

<blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;
margin-left:4.8pt;margin-right:0in'>

<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>Denis Beauchemin a écrit
:<br>
&gt; Release Name: 0.88.7<br>
&gt;<br>
&gt; Hello all,<br>
&gt;<br>
&gt; Our security guy pointed the following advisory for Clam 0.88.6 and<br>
&gt; prior versions: <a
href="http://www.frsirt.com/english/advisories/2006/4948">http://www.frsirt.com/english/advisories/2006/4948</a><br>
&gt; Clam AntiVirus MIME Attachments Handling Remote Denial of Service<br>
&gt; Vulnerability<br>
&gt;<br>
&gt; This comes from Clam 0.88.7:<br>
&gt; This version improves scanning of mail and tar files. <br>
&gt;<br>
&gt; Changes:<br>
&gt; Mon Dec 11 02:47:03 CET 2006<br>
&gt; ----------------------------<br>
&gt;&nbsp;&nbsp;* Bugfixes:<br>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;- libclamav/message.c: handle consecutive errors in
base64 decoding<br>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;- libclamav/mbox.c: honour recursion limit when
scanning email <br>
&gt; messages<br>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;- clamscan: new option --mail-max-recursion<br>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;- clamd/clamav-milter: new option MailMaxRecursion<br>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;- libclamav/untar.c: honour archive limits<br>
&gt;<br>
&gt; Denis<br>
&gt;<br>
Just wanted to let you know that there seems to be a problem with the<br>
new ClamAV and ZIP files: I get a lot of:<br>
Dec 12 12:37:52 <a href="http://132.210.244.93"></span></font></b><font color="red"><b>MailScanner has detected a possible fraud attempt from "132.210.244.93" claiming to be</b></font> <b><font color=red><span
style='color:red;font-weight:bold'>MailScanner warning: numerical links are
often malicious: 132.210.244.93</a> MailScanner[31880]:<br>
ClamAVModule::INFECTED:: Oversized.Zip::<br>
./kBCHaqdS004063/BIOMETISS_BIOREACTEUR_07-12-2006.zip<br>
<br>
I had none yesterday and I have 20 since upgrading Clam this morning.<br>
<br>
Denis<br>
<br>
--<br>
&nbsp;&nbsp; _<br>
&nbsp;&nbsp;°v°&nbsp;&nbsp; Denis Beauchemin, analyste<br>
/(_)\&nbsp;&nbsp;Université de Sherbrooke, S.T.I.<br>
&nbsp;&nbsp;^ ^&nbsp;&nbsp; T: 819.821.8000x62252 F: 819.821.8045<br>
<br>
<br>
<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info
</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting
</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br>
<br>
<o:p></o:p></span></font></p>

</blockquote>

</div>

<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><br>
If anyone is still seeing this problem, we found that it's fixed by force
reinstalling the clamav perl module. According to the clamav developers: <o:p></o:p></span></font></p>

<div style='margin-left:30.0pt'>

<p class=MsoNormal><font size=2 color=black face=Verdana><span
style='font-size:10.0pt;font-family:Verdana;color:black'>Due to the changes in
libclamav, 0.88.7 is not binary compatible with previous <br>
versions. To solve the issues you have to recompile all the software which is <br>
linked against libclamav. </span></font><o:p></o:p></p>

</div>

<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><br>
-- <br>
Regards,<br>
Sarah Trayser<o:p></o:p></span></font></p>

</div>

</body>

</html>