Skip to main content

[CPANEL-20678] ClamAV freshclam and clamscan binaries are different versions.

jndawson
We got an email alert from a server that has had the ClamAV plugin installed for at least 5 years (and Manage Plugins' indicates it's properly installed):
ClamAV freshclam and clamscan binaries are different versions. Install ClamAV within "Manage Plugins".
We just updated to v.66.0.22 last night during normal update cycle. We've received no binary mismatch notice on any other servers. We decided to remove the plugin and reinstall it. Seemed to go well, 'Manage Plugins' indicates it's properly installed and 'Service Status' indicates it's running. Just for grins, we restarted clamd to be sure all was copacetic:
[ root@cp2 ~># /scripts/restartsrv_clamd Waiting for "clamd"clamd" Service Status clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 21668 (pidfile+/proc check method). Startup Log LibClamAV Warning: Detected duplicate databases /usr/local/cpanel/3rdparty/share/clamav/main.cvd and /usr/local/cpanel/3rdparty/share/clamav/main.cld, please manually remove one of them clamd restarted successfully.
Here's what we've got:
[ root@cp2 ~># ls -l /usr/local/cpanel/3rdparty/share/clamav/main* -rw-r--r-- 1 clamav clamav 307499008 Jun 7 21:09 /usr/local/cpanel/3rdparty/share/clamav/main.cld -rw-r--r-- 1 clamav clamav 117892267 Sep 14 11:06 /usr/local/cpanel/3rdparty/share/clamav/main.cvd
main.cvd apparently created when reinstalling the plugin; main.cld apparently the old one which should be removed. Correct? If so, do we need to reinstall the clamAV plugin on the other servers? And any reason/speculation why this occurred?

Comments

23 comments

Date Votes
  • cPanelMichael
    ClamAV freshclam and clamscan binaries are different versions. Install ClamAV within "Manage Plugins".

    Hello, Are you sure no other installations of ClamAV exist on this system? For instance, check to see the output of the following commands:
    rpm -qa|grep clam locate freshclam
    Thank you.
    0
  • jndawson
    Hello, Are you sure no other installations of ClamAV exist on this system? For instance, check to see the output of the following commands:
    rpm -qa|grep clam locate freshclam
    Thank you.

    We already did that:
    [ root@cp2 ~># rpm -qa|grep clam cpanel-clamav-0.99.2-2.cp1164.x86_64 cpanel-clamav-virusdefs-0.99.2-2.cp1164.x86_64 [ root@cp2 ~># locate freshclam /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/cpanel/3rdparty/etc/freshclam.conf /usr/local/cpanel/3rdparty/share/man/man1/freshclam.1 /usr/local/cpanel/3rdparty/share/man/man5/freshclam.conf.5 /var/asl/data/templates/template-freshclam.conf
    Still have the same questions, and no, none of our other servers have experienced the same weird error message.
    0
  • John W
    I have this same message after upcp ran this morning. But, nothing is different that I can find.
    0
  • cPanelMichael
    Hello, Could you open a support ticket using the link in my signature so we can take a closer look to see why the "ClamAV freshclam and clamscan binaries are different versions" notification was sent on the affected system? It should not be sent if the only installed ClamAV instance was enabled through the "WHM >> Manager Plugins" interface. Thank you.
    0
  • verdon
    I just received this same alert overnight. CENTOS 6.9 standard - v66.0.27
    # rpm -qa|grep clam cpanel-clamav-0.99.2-2.cp1164.x86_64 cpanel-clamav-virusdefs-0.99.2-2.cp1164.x86_64 # locate freshclam /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/cpanel/3rdparty/etc/freshclam.conf /usr/local/cpanel/3rdparty/share/man/man1/freshclam.1 /usr/local/cpanel/3rdparty/share/man/man5/freshclam.conf.5
    0
  • cPanelMichael
    Hello @verdon, Could you open a support ticket using the link in my signature so we can take a closer look? Thank you.
    0
  • verdon
    Hi, I'm so sorry. I completely missed this reply @cPanelMichael. Is there any point after this amount of time, and an update to v.68. Is there something I can test? I have not received this notification since. Just the one time.
    0
  • cPanelMichael
    I'm so sorry. I completely missed this reply @cPanelMichael. Is there any point after this amount of time, and an update to v.68. Is there something I can test? I have not received this notification since. Just the one time.

    We could check to make sure there are no rogue copies of ClamAV or FreshClam installed on the system. Thank you.
    0
  • verdon
    We could check to make sure there are no rogue copies of ClamAV or FreshClam installed on the system. Thank you.

    No. Thank you :-) Ticket ID 9011467
    0
  • jndawson
    No. Thank you :) Ticket ID 9011467

    What was the result?
    0
  • verdon
    What was the result?

    Only that there were no rogue/extra copies of ClamAV or FreshClam on the system. There had been an update to whm v.68 run on the server since the initial incident, and it's possible that any duplicate was cleaned up then. I suppose it's possible it was just a false positive to begin with as well. I don't know, but it is all good now.
    0
  • PeteS
    I have the same message. It showed up in the 5/53 upcp. In the 5/22 upcp clamav updated to 0.99.4-3 and cPanel upgraded to v70.0.43. So it looks like clamav and cPanel updated at the same time, then the next upcp raised this error. Is this a bug in the update? I see the v70.0.44 just updated last night. I can run the above checks and do an un/re-install of clamav (then recheck) but I would like to hear the results of more of the tickets that are opened. (The one that reported above seemed to indicate that the above solution was adequate.) @cPanelMichael, it would be helpful to have an official report on what this is about and why it (apparently) happens. FYI clamav was only installed on this server through WHM and has been maintained via WHM. -Pete
    0
  • NikRB
    Same alert for me. I installed ClamAV via WHM yesterday on a new server received this message today.
    0
  • cPanelMichael
    Hello Everyone, The Security Advisor State Change notification (configurable in WHM >> Contact Manager) is sent when a change to the state of a security issue is detected as part of the /usr/local/cpanel/scripts/check_security_advice_changes script. This script runs automatically during the cPanel update, and includes an assessment of the freshclam and clanscan versions. Based on the reports on this thread, it's possible the ClamAV update that occurs during the cPanel update is not completing successfully or is still in-progress when the check_security_advice_changes script runs. However, I've been unable to reproduce this issue on a test system. Could someone facing this issue recently open a support ticket and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary. Thank you.
    0
  • PeteS
    Same alert for me. I installed ClamAV via WHM yesterday on a new server received this message today.

    Thanks for posting that! I think it's a different scenario (not tied to an update cPanel) that's causing this. Can you post which cPanel version you are on now, and whether it was the same version when you installed clamav? -Pete
    0
  • cPanelMichael
    Thanks for posting that! I think it's a different scenario (not tied to an update cPanel) that's causing this.

    Hello Pete, A quick way to verify this is by reviewing the time stamps on the notification history reports:
    ls -al /var/cpanel/user_notifications/root/history
    Thank you.
    0
  • PeteS
    Based on the reports on this thread, it's possible the ClamAV update that occurs during the cPanel update is not completing successfully or is still in-progress when the check_security_advice_changes script runs. However, I've been unable to reproduce this issue on a test system.

    My upcp report for 5/24 reports no issues for /usr/local/cpanel/scripts/check_security_advice_changes. [LIST]
  • 5/22 upcp updated clamav and cPanel v70.0.43, no clamav error, but reported 2 out of date executables running (possibly clamav?) for which I was unable to determine the process (see: Security Advisor notifications should include process name, not just PID), which may explain the lack of a clamav warning
  • 5/23 upcp reported the clamav error
  • 5/23 upcp updated cPanel to v70.0.44 and reported no clamav error It appears to me that it may be related to cPanel updates. -Pete
    • 0
  • PeteS
    Hello Pete, A quick way to verify this is by reviewing the time stamps on the notification history reports:
    ls -al /var/cpanel/user_notifications/root/history
    Thank you.

    We cross posted... :) That's what I did, but using the emails from upcp which gives me more detail on the warnings. -Pete
    0
  • cPanelMichael
    Hello Pete, Could you open a support ticket to report that this continues to happen and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary. Thank you.
    0
  • PeteS
    Hello Pete, Could you open a support ticket to report that this continues to happen and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary. Thank you.

    Support Request ID is: 9624873 (I'm #45 now but may move backward for a while, if it's like my ticket from a couple days ago. ;) )
    0
  • PeteS
    @cPanelMichael Will you be compiling a response to ticket(s), or did you want me to post their responses here? (In short, he could see that it happened, and that is had resolved itself, but not *why* it happened.) Edit: it's being escalated to a Level 2 Analyst; I'll stand by... -Pete
    0
  • cPanelMichael
    Hello Pete, Thank you for taking the time to submit the support ticket. Internal case CPANEL-20678 is now open to address the issue where /usr/local/cpanel/scripts/check_security_advice_changes can sometimes falsely report a mismatch between the freshclam and clamscan binaries. I'll monitor this case and update this thread with more information as it becomes available. Thank you.
    0
  • cPanelMichael
    Hello, To update, this is fixed as part of updates to Security Advisor in cPanel & WHM version 78. Version 78 is tentatively planned for publication to the RELEASE tier later this week. Thank you.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post