After more than a year of development, Cisco has released the free antivirus package ClamAV 1.5.0. The project came under Cisco's ownership in 2013 following its acquisition of Sourcefire, the company behind ClamAV and Snort. The project's code is distributed under the GPLv2 license. The 1.5.0 branch is categorized as a regular (not LTS) version, with updates published for at least 4 months after the release of the first version of the next branch. The ability to download signature databases for non-LTS branches is also provided for at least another 4 months after the release of the next branch.
Key changes in ClamAV 1.5:
- Added a check that identifies encrypted Microsoft Office documents.
- Added the capability to extract links present in processed HTML and PDF files. Links are output in JSON format when JSON metadata generation mode is active. This feature can be disabled using the ClamScan command-line options '—json-store-html-uris=no' and '—json-store-pdf-uris=no', or through the directives 'JsonStoreHTMLURIs no' and 'JsonStorePDFURIs no' in clamd.conf, or the environment variables CL_SCAN_GENERAL_STORE_HTML_URIS and CL_SCAN_GENERAL_STORE_PDF_URIS.
- In the 'OnAccessExcludePath' setting, it is now possible to set file path exclusion masks using regular expressions.
- Support has been added for verifying and signing digital signatures for signature database archives (CVD) and changes to the database (CDIFF) using external files with the '.sign' extension, which are automatically downloaded by the Freshclam utility along with the CVD databases and CDIFF patches. To verify and generate signatures, the 'sigtool verify' and 'sigtool sign' commands can be used. The certificates used are set by default in the '/etc/certs' directory, which can be changed during compilation via the '-D CVD_CERTS_DIRECTORY=PATH' option, the CVDCertsDirectory setting, the CVD_CERTS_DIR environment variable, or the command line parameter '—cvdcertsdir PATH'.
- The Freshclam, ClamD, ClamScan, and Sigtool programs now include the ability to disable the unreliable hashing algorithms MD5 and SHA1 when verifying digital signatures and checking false positives for trusted files. Disabling MD5 and SHA1 is achieved through the 'FIPSCryptoHashLimits' setting or the '—fips-limits' option.
- In the implementation of the cache for verified files, the SHA2-256 algorithm is used instead of MD5.
- Clamd has added settings EnableShutdownCommand, EnableReloadCommand, EnableStatsCommand, and EnableVersionCommand to disable the handling of shutdown, restart, statistics output, and version display commands.
- libclamav has added additional functions for scanning operations, enhanced features for hash handling, and options for managing recursive directory traversals with temporary files. Each scanned object is assigned a unique object identifier.
- The ClamScan utility has improved the accuracy of counters for the size of read and scanned data. It now includes the ability to display sizes in gigabytes, megabytes, kilobytes, or bytes.
- New command-line options have been added to ClamScan: '--hash-hint', '--log-hash', '--file-type-hint', and '--log-file-type'.
- The maximum value for the max-recursion setting in the configuration file is limited to 100 to prevent failures when processing files with deep recursion.
- The code quality in the ZIP archive module has been improved. Enhanced support for extracting data from corrupted zip archives has also been introduced.
- File type detection with AI models has been implemented.
- It is now allowed to specify a comment at the end of a line with an active option (e.g., 'LogVerbose yes #no').
- On the Windows platform, support for file names with UTF-8 characters not marked in ANSI and OEM code pages has been improved.
- Build support for GNU/Hurd, Solaris, and AIX platforms has been enhanced.
Source: opennet.ru
