[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-id: <FBF3AE41-DB79-43A7-A4FB-806C3702EC7E@me.com>
Date: Tue, 03 Oct 2017 11:34:09 -0400
From: Joel Esler <joel.esler@...com>
To: oss-security@...ts.openwall.com
Cc: Hanno Böck <hanno@...eck.de>
Subject: Re: clamav: Out of bounds read and segfault in xar
parser
Hello — My name is Joel Esler, I’m the Open Source lead here for ClamAV at Cisco. A few comments here on list inline below:
> On Oct 1, 2017, at 3:37 AM, Eddie Chapman <eddie@...k.net> wrote:
>
> On 29/09/17 14:09, Hanno Böck wrote:
>> Meta-level comment:
>> It seems to me clamav development has mostly stalled. Detection rates
>> are very low and I'm considering to stop using it for mail filtering.
>> (also there's of course the whole AV debate, however I never saw
>> clamav as a security tool, more as something like a spam filter that
>> prevents crap in my inbox. Still of course it needs to have secure
>> parsers.)
>
> I agree with much of this, and I think you're right that the effectiveness of Clamav in mail filtering contexts can be debated, though maybe more in terms of the AV debate, as you say. As a user myself with it deployed filtering multi-user domains, I agree that detection rates are low.
Something we were working on. To be honest, shipping detection in the method that we currently ship detection is not going to scale. We are thinking about ways to change this.
>
> However, checking just now on Github I do not get the impression at all that development has stalled. Judging purely by number of commits, every month there are consistently a very healthy number. But what has stalled is stable releases; the last one being 0.99.2 on 22nd April 2016, so something is not quite right. But I've seen many open source/free software projects stalled over the years and definitely Clamav does not, IMO, fit that description (at least not yet).
It’s not dead. At all. 99.2 as a stable release was released in 2016, yes. We have been working on 99.3 since, and are planning 99.4 and 99.5 now. 99.3 has been in beta for a couple months now, and the fix for this issue has been in git since the date mentioned earlier in the thread. It’s also obviously in 99.3.
--
Joel Esler
Manager
Talos Group
http://www.talosintelligence.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
