Pete 'Wolfy' Hanson wrote:
Using clamav 0.87.1 with clamav-milter 0.87 under sendmail 8.13.5 on Solaris
8, I've started seeing this type of stuff in the clam logs
Dec 12 09:18:00 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.MzvOKK creation
failed
Dec 12 09:18:04 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHWTc024980: /tmp/clamav-2993fbe6371a9f93/msg.sAvOKK: No viruses detected
ERROR
Dec 12 09:18:02 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.RzvOKK creation
failed
Dec 12 09:18:02 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.XzvOKK creation
failed
Dec 12 09:18:02 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.2zvOKK creation
failed
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHiNS025141: /tmp/clamav-2993fbe6371a9f93/msg._zvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHWTf024992: /tmp/clamav-2993fbe6371a9f93/msg.aAvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHiN5025133: /tmp/clamav-2993fbe6371a9f93/msg.bAvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHZG8025036: /tmp/clamav-2993fbe6371a9f93/msg.GzvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHaio025041: /tmp/clamav-2993fbe6371a9f93/msg.HzvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHWM5024981: /tmp/clamav-2993fbe6371a9f93/msg.6zvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHrWb025232: /tmp/clamav-2993fbe6371a9f93/msg.vAvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.FAvOKK creation
failed
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHhjc025132: /tmp/clamav-2993fbe6371a9f93/msg.5zvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 801593 local7.error]
jBCHHtlf025246: /tmp/clamav-2993fbe6371a9f93/msg.kAvOKK: No viruses detected
ERROR
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.AAvOKK creation
failed
Dec 12 09:18:05 smtp clamav-milter[18725]: [ID 984059 local7.error]
Temporary quarantine file /tmp/clamav-2993fbe6371a9f93/msg.LAvOKK creation
failed
followed by clamav-milter no longer working (it needs to be restarted).
This is quite similar to a previously reported DoS vulnerability in older
versions of clamav:
http://www.idefense.com/application/poi/display?id=276&type=vulnerabilities&flashstatus=true
That is a different issue.
It's not an urgent problem for me since I have some simple monitors that
restart clamav-milter as needed.
Has your /tmp filesystem become full?
--
Pete Hanson
--
Nigel Horne. Arranger, Adjudicator, Band Trainer, Composer, Typesetter.
NJH Music, Barnsley, UK. ICQ#20252325
[EMAIL PROTECTED] http://www.bandsman.co.uk
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
