Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ClamAV 1.0.7 (LTS): freshclam counts custom sigs in wdb wrong #1390

Open
MarkyMarkDE opened this issue Oct 18, 2024 · 0 comments · May be fixed by #1397
Open

ClamAV 1.0.7 (LTS): freshclam counts custom sigs in wdb wrong #1390

MarkyMarkDE opened this issue Oct 18, 2024 · 0 comments · May be fixed by #1397

Comments

@MarkyMarkDE
Copy link

MarkyMarkDE commented Oct 18, 2024

It is no secret that freshclam counts the lines to determine the signatures in the file.
But i found a Bug in the way how freshclam handles wdb files.

My freshclam.log:

Fri Oct 18 12:00:04 2024 -> --------------------------------------
Fri Oct 18 12:00:04 2024 -> daily database available for update (local version: 27430, remote version: 27431)
Fri Oct 18 12:00:10 2024 -> daily.cld updated (version: 27431, sigs: 2067283, f-level: 90, builder: raynman)
Fri Oct 18 12:00:10 2024 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Fri Oct 18 12:00:10 2024 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman)
Fri Oct 18 12:00:10 2024 -> Downloading whitelist.wdb [100%]
Fri Oct 18 12:00:10 2024 -> whitelist.wdb updated (version: custom database, sigs: 7)

You see sigs 7

My whitelist.wdb source code:
--- START --

#
# Phishing-Whitelist whitelist.wdb
# newcomer01@newcomer01-MS-7A40
# ClamAV - 1.0.7 (ClamAV 1.0.7) - 18.10.2024, 10:22:55 +0200
# /var/lib/clamav_cronjob/clamav_whitelistmake.sh
# Stand 28.09.2024 (1.0.7)
#

# Ausnahmeregeln fuer Sparkasse und Sparkasse Langen-Seligenstadt
X:.+(facebook|twitter|instagram|youtube|play.google|apps.apple).com([/?].)?:.+mailing.(sparkasse|sls-direkt).de([/?].)?:17-
X:.+(sparkasse|sls-direkt).de([/?].)?:.+mailing.(sparkasse|sls-direkt).de([/?].)?:17-

# Ausnahmeregel fuer Amazon und Amazon-Subdomains
X:.+.amazon.(at|ca|co.uk|co.jp|de|fr)([/?].)?:.+.amazon.com([/?].)?:17-

--- END ---

It contains 16 lines in total (correct, with comment lines and blank lines).

Now freshclam remove all comment lines incl. the line itself, similar to this:
COUNT_SIGS_WHITELIST="$(sed -E '/^[\r\n\t\f\v ]*#/d;s/#.*//g' "/var/lib/clamav/whitelist.wdb" | wc -l | cut -d ' ' -f 1)" && wait ${!}
The result of ${COUNT_SIGS_WHITELIST} are 7 lines and this is the amount of "sigs" what freshclam counts, but this is wrong.

Maybe Correct handle (works in my case):
COUNT_SIGS_WHITELIST="$(grep -E -o '^[^#]*' "/var/lib/clamav/whitelist.wdb" | wc -l | cut -d ' ' -f 1)" && wait ${!}
The result of ${COUNT_SIGS_WHITELIST} are now 3 lines and this is the right result, I have 3 "sigs" in total (3 filled lines after removing all comment lines and blank lines).

I'm on Ubuntu 24.04.1 and ClamAV 1.0.7

I have searched all the source code for how ClamAV countlines works, but have found nothing.
I'm pretty sure, there must be some kind of line or file cleanup.

Perhaps there are even important reasons why blank lines are not removed, but unfortunately I can't find any rules in the source code. The ticket is certainly not a high priority one, but I just wanted to point this out.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant