Package: clamav-daemon Version: 0.100.0+dfsg-0+deb9u1 Severity: important Hi,
after upgrading my Stretch mailserver with the packages from stretch-proposed-updates clamav-daemon dies with the following error message root@mail:~# systemctl status clamav-daemon ● clamav-daemon.service - Clam AntiVirus userspace daemon Loaded: loaded (/lib/systemd/system/clamav-daemon.service; enabled; vendor preset: enabled) Drop-In: /etc/systemd/system/clamav-daemon.service.d └─extend.conf Active: failed (Result: signal) since Tue 2018-07-03 07:40:12 CEST; 1h 18min ago Docs: man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/ Process: 21927 ExecStart=/usr/sbin/clamd --foreground=true (code=killed, signal=ABRT) Process: 21923 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS) Process: 21922 ExecStartPre=/bin/mkdir /run/clamav (code=exited, status=1/FAILURE) Main PID: 21927 (code=killed, signal=ABRT) Jul 03 07:30:24 mail clamd[21927]: LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 544 undefined identifier "pe" Jul 03 07:30:24 mail clamd[21927]: LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 557 undefined identifier "pe" Jul 03 07:30:24 mail clamd[21927]: LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 603 undefined identifier "pe" Jul 03 07:30:24 mail clamd[21927]: LibClamAV Error: yyerror(): /var/lib/clamav/antidebug_antivm.yar line 614 undefined identifier "pe" Jul 03 07:30:24 mail clamd[21927]: LibClamAV Warning: cli_loadyara: failed to parse or load 7 yara rules from file /var/lib/clamav/antidebug_antivm.yar, successfully Jul 03 07:30:36 mail clamd[21927]: Tue Jul 3 07:30:36 2018 -> Database correctly reloaded (6790696 signatures) Jul 03 07:40:12 mail clamd[21927]: clamd: yara_exec.c:177: yr_execute_code: Assertion `sp == 0' failed. Jul 03 07:40:12 mail systemd[1]: clamav-daemon.service: Main process exited, code=killed, status=6/ABRT Jul 03 07:40:12 mail systemd[1]: clamav-daemon.service: Unit entered failed state. Jul 03 07:40:12 mail systemd[1]: clamav-daemon.service: Failed with result 'signal'. 0.99.4+dfsg-1+deb9u1 -> 0.100.0+dfsg-0+deb9u1 This is probably related to using third-party signatures, but still a regression. Best Regards, Bernhard -- Package-specific info: --- configuration --- Checking configuration files in /etc/clamav Config file: clamd.conf ----------------------- BlockMax disabled PreludeEnable disabled PreludeAnalyzerName = "ClamAV" LogFile = "/var/log/clamav/clamav.log" LogFileUnlock disabled LogFileMaxSize = "4294967295" LogTime = "yes" LogClean disabled LogSyslog disabled LogFacility = "LOG_LOCAL6" LogVerbose disabled LogRotate = "yes" ExtendedDetectionInfo = "yes" PidFile disabled TemporaryDirectory disabled DatabaseDirectory = "/var/lib/clamav" OfficialDatabaseOnly disabled LocalSocket = "/var/run/clamav/clamd.ctl" LocalSocketGroup = "clamav" LocalSocketMode = "666" FixStaleSocket = "yes" TCPSocket disabled TCPAddr disabled MaxConnectionQueueLength = "15" StreamMaxLength = "26214400" StreamMinPort = "1024" StreamMaxPort = "2048" MaxThreads = "12" ReadTimeout = "180" CommandReadTimeout = "5" SendBufTimeout = "200" MaxQueue = "100" IdleTimeout = "30" ExcludePath disabled MaxDirectoryRecursion = "15" FollowDirectorySymlinks disabled FollowFileSymlinks disabled CrossFilesystems = "yes" SelfCheck = "3600" DisableCache disabled VirusEvent disabled ExitOnOOM disabled AllowAllMatchScan = "yes" Foreground disabled Debug disabled LeaveTemporaryFiles disabled User = "clamav" Bytecode = "yes" BytecodeSecurity = "TrustSigned" BytecodeTimeout = "60000" BytecodeUnsigned disabled BytecodeMode = "Auto" DetectPUA disabled ExcludePUA disabled IncludePUA disabled AlgorithmicDetection = "yes" ScanPE = "yes" ScanELF = "yes" DetectBrokenExecutables disabled ScanMail = "yes" ScanPartialMessages disabled PhishingSignatures = "yes" PhishingScanURLs = "yes" PhishingAlwaysBlockCloak disabled PhishingAlwaysBlockSSLMismatch disabled PartitionIntersection disabled HeuristicScanPrecedence disabled StructuredDataDetection disabled StructuredMinCreditCardCount = "3" StructuredMinSSNCount = "3" StructuredSSNFormatNormal = "yes" StructuredSSNFormatStripped disabled ScanHTML = "yes" ScanOLE2 = "yes" OLE2BlockMacros disabled ScanPDF = "yes" ScanSWF = "yes" ScanXMLDOCS = "yes" ScanHWP3 = "yes" ScanArchive = "yes" ArchiveBlockEncrypted disabled ForceToDisk disabled MaxScanSize = "104857600" MaxFileSize = "26214400" MaxRecursion = "16" MaxFiles = "10000" MaxEmbeddedPE = "10485760" MaxHTMLNormalize = "10485760" MaxHTMLNoTags = "2097152" MaxScriptNormalize = "5242880" MaxZipTypeRcg = "1048576" MaxPartitions = "50" MaxIconsPE = "100" MaxRecHWP3 = "16" PCREMatchLimit = "10000" PCRERecMatchLimit = "5000" PCREMaxFileSize = "26214400" ScanOnAccess disabled OnAccessMountPath disabled OnAccessIncludePath disabled OnAccessExcludePath disabled OnAccessExcludeRootUID disabled OnAccessExcludeUID disabled OnAccessMaxFileSize = "5242880" OnAccessDisableDDD disabled OnAccessPrevention disabled OnAccessExtraScanning disabled DevACOnly disabled DevACDepth disabled DevPerformance disabled DevLiblog disabled DisableCertCheck disabled Config file: freshclam.conf --------------------------- LogFileMaxSize = "4294967295" LogTime = "yes" LogSyslog disabled LogFacility = "LOG_LOCAL6" LogVerbose disabled LogRotate = "yes" PidFile disabled DatabaseDirectory = "/var/lib/clamav" Foreground disabled Debug disabled UpdateLogFile = "/var/log/clamav/freshclam.log" DatabaseOwner = "clamav" Checks = "12" DNSDatabaseInfo = "current.cvd.clamav.net" DatabaseMirror = "db.local.clamav.net", "db.ipv6.clamav.net", "database.clamav.net" PrivateMirror disabled MaxAttempts = "5" ScriptedUpdates = "yes" TestDatabases = "yes" CompressLocalDatabase disabled ExtraDatabase disabled DatabaseCustomURL disabled HTTPProxyServer disabled HTTPProxyPort disabled HTTPProxyUsername disabled HTTPProxyPassword disabled HTTPUserAgent disabled NotifyClamd = "/etc/clamav/clamd.conf" OnUpdateExecute disabled OnErrorExecute disabled OnOutdatedExecute disabled LocalIPAddress disabled ConnectTimeout = "30" ReceiveTimeout = "30" SafeBrowsing disabled Bytecode = "yes" clamav-milter.conf not found Software settings ----------------- Version: 0.100.0 Optional features supported: MEMPOOL IPv6 FRESHCLAM_DNS_FIX AUTOIT_EA06 BZIP2 LIBXML2 PCRE ICONV JSON JIT Database information -------------------- Database directory: /var/lib/clamav [3rd Party] bofhland_malware_URL.ndb: 2 sigs [3rd Party] spamattach.hdb: 14 sigs [3rd Party] sanesecurity.ftm: 170 sigs [3rd Party] EK_Angler.yar: 283 sigs [3rd Party] winnow_bad_cw.hdb: 1 sig [3rd Party] foxhole_generic.cdb: 211 sigs [3rd Party] EK_Sakura.yar: 62 sigs [3rd Party] junk.ndb: 56760 sigs [3rd Party] EK_Fragus.yar: 210 sigs [3rd Party] winnow.attachments.hdb: 5894 sigs [3rd Party] scam.ndb: 12485 sigs [3rd Party] EK_Phoenix.yar: 483 sigs [3rd Party] winnow_malware.hdb: 293 sigs [3rd Party] foxhole_filename.cdb: 1613 sigs [3rd Party] bofhland_malware_attach.hdb: 1835 sigs [3rd Party] bofhland_phishing_URL.ndb: 22 sigs daily.cld: version 24718, sigs: 2002049, built on Tue Jul 3 06:42:19 2018 [3rd Party] EK_Eleonore.yar: 165 sigs [3rd Party] porcupine.ndb: 3174 sigs [3rd Party] malwarehash.hsb: 771 sigs [3rd Party] winnow_malware_links.ndb: 4623 sigs [3rd Party] Sanesecurity_spam.yara: 46 sigs [3rd Party] rfxn.ndb: 2028 sigs [3rd Party] bofhland_cracked_URL.ndb: 18 sigs [3rd Party] EK_Blackhole.yar: 453 sigs bytecode.cld: version 322, sigs: 90, built on Fri Jun 22 16:08:32 2018 [3rd Party] phishtank.ndb: 33249 sigs [3rd Party] rogue.hdb: 4496 sigs [3rd Party] EK_ZeroAcces.yar: 211 sigs [3rd Party] rfxn.hdb: 12602 sigs [3rd Party] Sanesecurity_sigtest.yara: 54 sigs [3rd Party] winnow_extended_malware.hdb: 245 sigs [3rd Party] EK_BleedingLife.yar: 112 sigs [3rd Party] antidebug_antivm.yar: 1812 sigs [3rd Party] EK_Zerox88.yar: 55 sigs [3rd Party] winnow_malware.yara: 169 sigs [3rd Party] blurl.ndb: 46614 sigs [3rd Party] EK_Crimepack.yar: 49 sigs [3rd Party] porcupine.hsb: 311 sigs main.cld: version 58, sigs: 4566249, built on Wed Jun 7 23:38:10 2017 [3rd Party] spamimg.hdb: 158 sigs [3rd Party] EK_Zeus.yar: 28 sigs [3rd Party] phish.ndb: 27394 sigs [3rd Party] jurlbl.ndb: 13082 sigs [3rd Party] hackingteam.hsb: 435 sigs Total number of signatures: 6801080 Platform information -------------------- uname: Linux 4.9.0-7-amd64 #1 SMP Debian 4.9.107-1 (2018-06-13) x86_64 OS: linux-gnu, ARCH: x86_64, CPU: x86_64 Full OS version: Debian GNU/Linux 9.4 (stretch) zlib version: 1.2.8 (1.2.8), compile flags: a9 Triple: x86_64-pc-linux-gnu CPU: pentium2, Little-endian platform id: 0x0a215b5b0806030001060300 Build information ----------------- GNU C: 6.3.0 20170516 (6.3.0) GNU C++: 6.3.0 20170516 (6.3.0) CPPFLAGS: -Wdate-time -D_FORTIFY_SOURCE=2 CFLAGS: -g -O2 -fdebug-prefix-map=/build/clamav-oBKPFM/clamav-0.100.0+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64 -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 CXXFLAGS: -g -O2 -fdebug-prefix-map=/build/clamav-oBKPFM/clamav-0.100.0+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64 LDFLAGS: -Wl,-z,relro -Wl,-z,now -Wl,--as-needed Configure: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=/usr/include' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libdir=/usr/lib/x86_64-linux-gnu' '--libexecdir=/usr/lib/x86_64-linux-gnu' '--disable-maintainer-mode' '--disable-dependency-tracking' 'CFLAGS=-g -O2 -fdebug-prefix-map=/build/clamav-oBKPFM/clamav-0.100.0+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fdebug-prefix-map=/build/clamav-oBKPFM/clamav-0.100.0+dfsg=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -D_FILE_OFFSET_BITS=64' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now -Wl,--as-needed' '--with-dbdir=/var/lib/clamav' '--sysconfdir=/etc/clamav' '--disable-clamav' '--disable-unrar' '--enable-milter' '--enable-dns-fix' '--with-libjson' '--with-system-libmspack' '--with-libcurl=/usr' '--with-gnu-ld' '-with-system-llvm=/usr/bin/llvm-config' '--with-llvm-linking=dynamic' '--with-systemdsystemunitdir=/lib/systemd/system' 'build_alias=x86_64-linux-gnu' sizeof(void*) = 8 Engine flevel: 91, dconf: 91 --- data dir --- total 471560 -rw-r--r-- 1 clamav clamav 10889 Mar 6 22:55 EK_Angler.yar -rw-r--r-- 1 clamav clamav 14659 Mar 6 22:55 EK_Blackhole.yar -rw-r--r-- 1 clamav clamav 3401 Mar 6 22:55 EK_BleedingLife.yar -rw-r--r-- 1 clamav clamav 1349 Mar 6 22:55 EK_Crimepack.yar -rw-r--r-- 1 clamav clamav 4688 Mar 6 22:55 EK_Eleonore.yar -rw-r--r-- 1 clamav clamav 8268 Mar 6 22:55 EK_Fragus.yar -rw-r--r-- 1 clamav clamav 16842 Mar 6 22:55 EK_Phoenix.yar -rw-r--r-- 1 clamav clamav 1860 Mar 6 22:55 EK_Sakura.yar -rw-r--r-- 1 clamav clamav 8488 Mar 6 22:55 EK_ZeroAcces.yar -rw-r--r-- 1 clamav clamav 1435 Mar 6 22:55 EK_Zerox88.yar -rw-r--r-- 1 clamav clamav 800 Mar 6 22:55 EK_Zeus.yar -rw-r--r-- 1 clamav clamav 1462 Jul 1 2015 Sanesecurity_sigtest.yara -rw-r--r-- 1 clamav clamav 1233 Feb 22 2016 Sanesecurity_spam.yara -rw-r--r-- 1 clamav clamav 47013 Mar 6 22:55 antidebug_antivm.yar -rw-r--r-- 1 clamav clamav 7519880 Jul 3 07:11 blurl.ndb -rw-r--r-- 1 clamav clamav 1770 Jul 1 03:02 bofhland_cracked_URL.ndb -rw-r--r-- 1 clamav clamav 128 Jun 28 03:03 bofhland_malware_URL.ndb -rw-r--r-- 1 clamav clamav 106188 Mar 6 22:03 bofhland_malware_attach.hdb -rw-r--r-- 1 clamav clamav 2766 Jul 2 21:02 bofhland_phishing_URL.ndb -rw-r--r-- 1 clamav clamav 947712 Jun 22 17:10 bytecode.cld drwxr-xr-x 2 clamav clamav 4096 May 12 2013 clamav-0a47a4a7b96ec68cefacb0290f91268b -rw-r--r-- 1 clamav clamav 143277568 Jul 3 07:30 daily.cld -rw-r--r-- 1 clamav clamav 137631 Jun 29 10:10 foxhole_filename.cdb -rw-r--r-- 1 clamav clamav 51613 Mar 26 15:11 foxhole_generic.cdb -rw-r--r-- 1 clamav clamav 48176 Aug 5 2015 hackingteam.hsb -rw-r--r-- 1 clamav clamav 7111512 Jul 2 09:15 junk.ndb -rw-r--r-- 1 clamav clamav 1568640 Jul 3 07:11 jurlbl.ndb -rw-r--r-- 1 clamav clamav 307499008 Jun 7 2017 main.cld -rw-r--r-- 1 clamav clamav 73808 Jun 29 2017 malwarehash.hsb -rw-r--r-- 1 clamav clamav 3900 Jul 3 08:30 mirrors.dat -rw-r--r-- 1 clamav clamav 4038222 Jun 29 11:09 phish.ndb -rw-r--r-- 1 clamav clamav 5108426 Jul 1 11:01 phishtank.ndb -rw-r--r-- 1 clamav clamav 24284 Jul 3 05:01 porcupine.hsb -rw-r--r-- 1 clamav clamav 341666 Jul 3 07:01 porcupine.ndb -rw-r--r-- 1 clamav clamav 848077 May 9 07:36 rfxn.hdb -rw-r--r-- 1 clamav clamav 450812 Jun 20 19:08 rfxn.ndb -rw-r--r-- 1 clamav clamav 490895 Jul 2 16:11 rogue.hdb -rw-r--r-- 1 clamav clamav 11098 Oct 18 2016 sanesecurity.ftm -rw-r--r-- 1 clamav clamav 1895835 Jun 26 22:12 scam.ndb -rw-r--r-- 1 clamav clamav 328 Jun 12 14:10 sigwhitelist.ign2 -rw-r--r-- 1 clamav clamav 1391 Apr 28 2017 spamattach.hdb -rw-r--r-- 1 clamav clamav 15182 Jun 19 10:11 spamimg.hdb -rw-r--r-- 1 clamav clamav 526635 Mar 5 09:00 winnow.attachments.hdb -rw-r--r-- 1 clamav clamav 66 Mar 5 09:00 winnow_bad_cw.hdb -rw-r--r-- 1 clamav clamav 16271 Mar 5 09:00 winnow_extended_malware.hdb -rw-r--r-- 1 clamav clamav 18189 Mar 5 09:00 winnow_malware.hdb -rw-r--r-- 1 clamav clamav 3782 Mar 5 09:00 winnow_malware.yara -rw-r--r-- 1 clamav clamav 506160 Jun 26 12:27 winnow_malware_links.ndb -- System Information: Debian Release: 9.4 APT prefers proposed-updates APT policy: (500, 'proposed-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-7-amd64 (SMP w/2 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages clamav-daemon depends on: ii adduser 3.115 ii clamav-base 0.100.0+dfsg-0+deb9u1 ii clamav-freshclam [clamav-data] 0.100.0+dfsg-0+deb9u1 ii debconf [debconf-2.0] 1.5.61 ii dpkg 1.18.25 ii init-system-helpers 1.48 ii libc6 2.24-11+deb9u3 ii libclamav7 0.100.0+dfsg-0+deb9u1 ii libncurses5 6.0+20161126-1+deb9u2 ii libssl1.1 1.1.0f-3+deb9u2 ii libsystemd0 232-25+deb9u3 ii libtinfo5 6.0+20161126-1+deb9u2 ii lsb-base 9.20161125 ii procps 2:3.3.12-3+deb9u1 ii ucf 3.0036 ii zlib1g 1:1.2.8.dfsg-5 Versions of packages clamav-daemon recommends: ii clamdscan 0.100.0+dfsg-0+deb9u1 Versions of packages clamav-daemon suggests: ii apparmor 2.11.0-3+deb9u2 pn clamav-docs <none> pn daemon <none> -- debconf information: clamav-daemon/MaxEmbeddedPE: 10M clamav-daemon/StatsHostID: auto clamav-daemon/LocalSocket: /var/run/clamav/clamd.ctl clamav-daemon/ScanMail: true clamav-daemon/DisableCertCheck: false clamav-daemon/AllowAllMatchScan: true clamav-daemon/ReadTimeout: 180 clamav-daemon/LogRotate: true clamav-daemon/debconf: true clamav-daemon/TCPSocket: 3310 clamav-daemon/ScanSWF: true clamav-daemon/BytecodeTimeout: 60000 clamav-daemon/SelfCheck: 3600 clamav-daemon/OnAccessMaxFileSize: 5M clamav-daemon/Bytecode: true clamav-daemon/MaxDirectoryRecursion: 15 clamav-daemon/LogSyslog: false clamav-daemon/FixStaleSocket: true clamav-daemon/TCPAddr: any clamav-daemon/MaxZipTypeRcg: 1M clamav-daemon/LogFile: /var/log/clamav/clamav.log clamav-daemon/StatsTimeout: 10 clamav-daemon/BytecodeSecurity: TrustSigned clamav-daemon/MaxScriptNormalize: 5M clamav-daemon/ScanArchive: true clamav-daemon/LogTime: true clamav-daemon/StatsEnabled: false clamav-daemon/MaxThreads: 12 clamav-daemon/MaxHTMLNormalize: 10M clamav-daemon/LocalSocketMode: 666 clamav-daemon/StatsPEDisabled: true clamav-daemon/ForceToDisk: false clamav-daemon/ScanOnAccess: false clamav-daemon/MaxConnectionQueueLength: 15 clamav-daemon/FollowFileSymlinks: false clamav-daemon/AddGroups: amavis clamav-daemon/TcpOrLocal: UNIX clamav-daemon/User: clamav clamav-daemon/StreamMaxLength: 25 clamav-daemon/LocalSocketGroup: clamav clamav-daemon/FollowDirectorySymlinks: false clamav-daemon/MaxHTMLNoTags: 2M