ClamAV Issue on January 26, 2018

Overview

On January 26, 2018 ClamAV released a problematic daily.cvd file.

Sentry instances that automatically applied this daily.cvd file via the ClamAV automatic update process may experience error messages similar to the following upon AV scanning request or response payloads:

35A00 - Clam AV virus scanning incoming document of size 8 bytes 
3531A - Clam AV daemon responds: /mnt/ramdisk/clam39253086.tmp: Can't create new file ERROR 
0E050 - Error virus scanning, blocking content 

 

ClamAV has released a new daily.cvd that resolves the problem.

Update on the recent "File Descriptors" issue in ClamAV

 

Mitigation

Take the following steps to resolve AV scanning issues in Forum Sentry caused by the daily update on January 26, 2018:

1. If you can't update the definitions immediately, first try disabling / enabling AV - this has been shown to resolve the problem immediately albeit only for a period of time, the issue will come back. This is a temporary fix only.

 

2. Update the definitions and ensure you have Daily file version: 24258 or newer. 

 

For more information see: 

Update on the recent "File Descriptors" issue in ClamAV

FAQ: How does Sentry get ClamAV Virus Definition Updates

ClamAV Update File Locations

0 Comments

Article is closed for comments.