Bug 25940 - clamav: wrong permissions on /etc/freshclam.conf prevent freshclam usage with authenticated proxy (rhbz#1733112)
Summary: clamav: wrong permissions on /etc/freshclam.conf prevent freshclam usage with...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-12-23 22:27 CET by David Walser
Modified: 2019-12-31 17:52 CET (History)
5 users (show)

See Also:
Source RPM: clamav-0.101.5-1.1.mga7.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2019-12-23 22:27:50 CET 
Fedora has issued an advisory on August 15:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2VA3SW62UWYAW52LVXEWN2KHAB7VTN2V/

Our package has 644 for the permissions, but it should be 600.

Mageia 7 is also affected.
David Walser 2019-12-23 22:28:05 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Nicolas Salguero 2019-12-24 14:19:56 CET 
Suggested advisory:
========================

The updated packages fix an issue:

Wrong permissions on /etc/freshclam.conf prevent freshclam usage with authenticated proxy. (rhbz#1733112)

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2VA3SW62UWYAW52LVXEWN2KHAB7VTN2V/
========================

Updated packages in core/updates_testing:
========================
clamav-0.101.5-1.2.mga7
clamd-0.101.5-1.2.mga7
clamav-milter-0.101.5-1.2.mga7
clamav-db-0.101.5-1.2.mga7
lib(64)clamav9-0.101.5-1.2.mga7
lib(64)clamav-devel-0.101.5-1.2.mga7

from SRPMS:
clamav-0.101.5-1.2.mga7.src.rpm

Whiteboard: MGA7TOO => (none)
Version: Cauldron => 7
Assignee: bugsquad => qa-bugs
Status: NEW => ASSIGNED
Source RPM: clamav-0.101.4-3.mga8.src.rpm => clamav-0.101.5-1.1.mga7.src.rpm
CC: (none) => nicolas.salguero

Comment 2 Herman Viaene 2019-12-28 13:39:07 CET 
MGA7-64 Plasma on Lenovo B50
No installation issues
Ref bug 25754 for tests
# ls -als /etc/freshclam.conf 
8 -rw------- 1 root root 6392 dec 24 13:59 /etc/freshclam.conf

# freshclam 
ClamAV update process started at Sat Dec 28 13:33:02 2019
WARNING: Your ClamAV installation is OUTDATED!
WARNING: Local version: 0.101.5 Recommended version: 0.102.1
DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav
etc ....
and 
# clamscan -vr
loads of files and at the end.
----------- SCAN SUMMARY -----------
Known viruses: 6636751
Engine version: 0.101.5
Scanned directories: 278
Scanned files: 1459
Infected files: 0
Data scanned: 33.53 MB
Data read: 17.67 MB (ratio 1.90:1)
Time: 25.257 sec (0 m 25 s)

I could also start the clamav-daemon, clamav-freshclam and clamav-milter services.
Looks good.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => herman.viaene

Comment 3 Thomas Andrews 2019-12-29 19:22:32 CET 
Validated. Advisory in Comment 1.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2019-12-31 17:03:21 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 4 Mageia Robot 2019-12-31 17:52:43 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0418.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED
Note You need to log in before you can comment on or make changes to this bug.