Package: clamav
Version: 0.90~rc2-2
Severity: normal
I'm using clamd from dansguardian to scan files our users are
downloading via our proxy servers. In general, this works great.
Unfortunately, clamd (and clamscan) seem to fail when given certain
PDF files.
I grepped for "Zip module failure" in the dansguardian's logs and
found these URLs:
% zgrep -h "Zip module failure" access.log* |awk '{print $5}'| sort | uniq
http://e-learning.studmed.unibe.ch/UroSurf/UroSurfdeutsch.pdf
http://users.path.ox.ac.uk/~scobbold/tig/tolweb/tolmec.pdf
http://www.kika.de/spielspass/basteln/stundenplaene/_dl/stundenplan_01.pdf
http://www.kika.de/spielspass/basteln/stundenplaene/_dl/stundenplan_02.pdf
http://www.prismacolor.de/download/prismacolor-preisliste2005-06.pdf
http://www.rth.info/luftrettung.pdf
http://www.ski-shop-charlottenburg.de/vertragsbedingungen.pdf
I picked the first URL, downloaded it without using the proxy and then
tried to clamscan it:
# clamscan UroSurfdeutsch.pdf
UroSurfdeutsch.pdf: Zip module failure
----------- SCAN SUMMARY -----------
Known viruses: 87232
Engine version: 0.90rc2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 0.19 MB
Time: 1.758 sec (0 m 1 s)
#
It's unclear to me what the problem is.
-- System Information:
Debian Release: 4.0
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.19.2
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages clamav depends on:
ii clamav-freshclam [clamav-dat 0.90~rc2-2 downloads clamav virus databases f
ii libc6 2.3.6.ds1-8 GNU C Library: Shared libraries
ii libclamav1 0.90~rc2-1 virus scanner library
ii zlib1g 1:1.2.3-13 compression library - runtime
Versions of packages clamav recommends:
ii arj 3.10.22-2 archiver for .arj files
ii clamav-base 0.90~rc2-2 base package for clamav, an anti-v
ii unzoo 4.4-5 zoo archive extractor
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
