ClamAV 1.5.0 Released with New MS Office and PDF Verification Features
Cisco has released ClamAV 1.5.0, an update to the open-source antivirus engine that brings enhanced security features, improved document scanning capabilities, and significant API enhancements.
Cisco has released ClamAV 1.5.0, an update to the open-source antivirus engine that brings enhanced security features, improved document scanning capabilities, and significant API enhancements.
Enhanced Detection and Cryptographic Integrity
This release focuses on improving the detection and verification mechanisms, especially for Microsoft Office documents and PDF files. A new feature allows identification of encrypted Microsoft Office documents using the OLE2 format, assisting in detecting potentially malicious files.
The update also improves metadata generation by enabling the recording of Uniform Resource Identifiers (URIs) found in HTML and PDF files. When the generate-JSON-metadata feature is active, ClamAV can log these links for threat analysis.
New configuration options, such as JsonStoreHTMLURIs and JsonStorePDFURIs , provide users with control over URI recording in JSON metadata.
This release focuses on improving the detection and verification mechanisms, especially for Microsoft Office documents and PDF files.
Strengthened Security and Signature Verification
Version 1.5.0 introduces CVD signing and verification using external .sign files. Freshclam will download these files with database and patch files, enhancing verification security. ClamAV now includes a certs directory and new configuration options to manage it.
This release also includes a FIPS-like limits option that disables MD5 and SHA1 for digital signature verification, addressing concerns over weaker hashing algorithms and meeting FIPS compliance requirements. The clean-file scan cache is updated from MD5 to SHA2-256.
The update offers extensive API improvements, including new functions like cl_cvdverify_ex and extended hashing functions, allowing for bypassing FIPS hash limits when necessary. New scan callback functions provide control at various scanning stages, including before hashing and scanning, and upon alert generation.
Additional improvements include regex support for the OnAccessExcludePath option, more precise byte-scanned counters in ClamScan, and new command-line options for providing hash and file-type hints.
The release addresses several bugs, including a stack buffer overflow in the phishing signature load process and an infinite loop issue when scanning certain email files. Other problems identified through static analysis have also been resolved.
Based on reporting by Cyber Security News.