Cisco has introduced a significant new release of the free antivirus package ClamAV 0.104.0. Note that the project was transferred to Cisco in 2013 after the acquisition of Sourcefire, which developed ClamAV and Snort. The project's code is distributed under the GPLv2 license.
At the same time, Cisco announced the start of forming ClamAV branches with long-term support (LTS), which will be maintained for three years from the release date of the first version in the branch. The first LTS branch will be ClamAV 0.103, and updates for security vulnerabilities and critical issues will be released until 2023.
Updates for non-LTS branches will be published for at least another 4 months after the release of the first version of the next branch (for example, updates for the ClamAV 0.104.x branch will be published for 4 more months after the release of ClamAV 0.105.0). The ability to download signature databases for non-LTS branches will also be available for at least another 4 months after the release of the next branch.
Another significant change has been the formation of official installation packages that allow updates without recompiling from source code and without waiting for packages to appear in distributions. Packages have been prepared for Linux (in RPM and DEB formats for x86_64 and i686 architectures), macOS (for x86_64 and ARM64, including support for the Apple M1 chip), and Windows (x64 and win32). In addition, the publication of official container images on Docker Hub has begun (images with both built-in signature databases and without them are offered). In the future, the publication of RPM and DEB packages for the ARM64 architecture and the release of builds for FreeBSD (x86_64) is planned.
Key improvements in ClamAV 0.104:
- Transition to the CMake build system, which is now mandatory for building ClamAV. Support for Autotools and Visual Studio build systems has been discontinued.
- The built-in LLVM components have been removed in favor of using existing external LLVM libraries. By default, a bytecode interpreter without JIT support is used for processing signatures with embedded bytecode at runtime. If LLVM is needed instead of the bytecode interpreter during compilation, explicit paths to LLVM 3.6.2 libraries must be specified (support for newer releases is planned for later).
- The clamd and freshclam processes are now available as Windows services. An option ‘—install-service’ is provided for installing these services, and the standard command ‘net start [name]’ can be used to start them.
- A new scanning option has been added to warn about the transfer of corrupted graphic files, through which vulnerabilities in graphic libraries could potentially be exploited. Format correctness checks have been implemented for JPEG, TIFF, PNG, and GIF files, and can be enabled via the AlertBrokenMedia setting in clamd.conf or the command-line option ‘—alert-broken-media’ in clamscan.
- New types CL_TYPE_TIFF and CL_TYPE_JPEG have been added for consistency with the file definition in GIF and PNG formats. BMP and JPEG 2000 types continue to be defined as CL_TYPE_GRAPHICS since format parsing is not supported for them.
- A visual progress indicator has been added to ClamScan for loading signatures and compiling the engine, which are carried out before scanning begins. The indicator does not display when launched outside the terminal or when one of the options ‘—debug’, ‘—quiet’, ‘—infected’, ‘—no-summary’ is specified.
- In libclamav, callback calls cl_engine_set_clcb_sigload_progress(), cl_engine_set_clcb_engine_compile_progress(), and engine free: cl_engine_set_clcb_engine_free_progress() have been added to display progress, allowing applications to track and assess the execution time of the preliminary stages of loading and compiling signatures.
- Support for the string formatting mask ‘%f’ has been added to the VirusEvent option for substituting the path of the file in which a virus is detected (similar to the mask ‘%v’ with the detected virus name). In VirusEvent, similar functionality is also available through the environment variables $CLAM_VIRUSEVENT_FILENAME and $CLAM_VIRUSEVENT_VIRUSNAME.
- The functionality of the AutoIt script unpacking module has been improved.
- Support for extracting images from *.xls files (Excel OLE2) has been added.
- Support has been added for uploading Authenticode hashes based on the SHA256 algorithm in the form of *.cat files (used for verifying Windows executable files signed with a digital signature).
Source: opennet.ru
