Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

[CPANEL-20678] ClamAV freshclam and clamscan binaries are different versions.

Discussion in 'Security' started by jndawson, Sep 14, 2017.

Tags:
Page 1 of 2
  1. jndawson

    jndawson Well-Known Member

    Joined:
    Aug 27, 2014
    Messages:
    198
    Likes Received:
    20
    Trophy Points:
    18
    Location:
    Western US
    cPanel Access Level:
    DataCenter Provider
    We got an email alert from a server that has had the ClamAV plugin installed for at least 5 years (and Manage Plugins' indicates it's properly installed):

    Code:
    ClamAV freshclam and clamscan binaries are different versions. Install ClamAV within "Manage Plugins".
    We just updated to v.66.0.22 last night during normal update cycle. We've received no binary mismatch notice on any other servers.

    We decided to remove the plugin and reinstall it. Seemed to go well, 'Manage Plugins' indicates it's properly installed and 'Service Status' indicates it's running.

    Just for grins, we restarted clamd to be sure all was copacetic:
    Code:
    [ root@cp2 ~># /scripts/restartsrv_clamd
Waiting for âclamdâclamdâ

Service Status
        clamd (/usr/local/cpanel/3rdparty/bin/clamd) is running as root with PID 21668 (pidfile+/proc check method).

Startup Log
        LibClamAV Warning: Detected duplicate databases /usr/local/cpanel/3rdparty/share/clamav/main.cvd and /usr/local/cpanel/3rdparty/share/clamav/main.cld, please manually remove one of them

clamd restarted successfully.
    Here's what we've got:

    Code:
    [ root@cp2 ~># ls -l /usr/local/cpanel/3rdparty/share/clamav/main*
-rw-r--r-- 1 clamav clamav 307499008 Jun  7 21:09 /usr/local/cpanel/3rdparty/share/clamav/main.cld
-rw-r--r-- 1 clamav clamav 117892267 Sep 14 11:06 /usr/local/cpanel/3rdparty/share/clamav/main.cvd
    main.cvd apparently created when reinstalling the plugin; main.cld apparently the old one which should be removed.

    Correct?

    If so, do we need to reinstall the clamAV plugin on the other servers? And any reason/speculation why this occurred?
     
    #1 jndawson, Sep 14, 2017
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Are you sure no other installations of ClamAV exist on this system? For instance, check to see the output of the following commands:

    Code:
    rpm -qa|grep clam
locate freshclam
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Sep 18, 2017
  3. jndawson

    jndawson Well-Known Member

    Joined:
    Aug 27, 2014
    Messages:
    198
    Likes Received:
    20
    Trophy Points:
    18
    Location:
    Western US
    cPanel Access Level:
    DataCenter Provider
    We already did that:
    Code:
    [ root@cp2 ~># rpm -qa|grep clam
cpanel-clamav-0.99.2-2.cp1164.x86_64
cpanel-clamav-virusdefs-0.99.2-2.cp1164.x86_64

[ root@cp2 ~># locate freshclam
/usr/local/cpanel/3rdparty/bin/freshclam
/usr/local/cpanel/3rdparty/etc/freshclam.conf
/usr/local/cpanel/3rdparty/share/man/man1/freshclam.1
/usr/local/cpanel/3rdparty/share/man/man5/freshclam.conf.5
/var/asl/data/templates/template-freshclam.conf
    Still have the same questions, and no, none of our other servers have experienced the same weird error message.
     
    #3 jndawson, Sep 18, 2017
  4. John W

    John W Member

    Joined:
    Aug 24, 2007
    Messages:
    15
    Likes Received:
    0
    Trophy Points:
    51
    Location:
    Orlando
    I have this same message after upcp ran this morning. But, nothing is different that I can find.
     
    #4 John W, Sep 19, 2017
  5. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you open a support ticket using the link in my signature so we can take a closer look to see why the "ClamAV freshclam and clamscan binaries are different versions" notification was sent on the affected system? It should not be sent if the only installed ClamAV instance was enabled through the "WHM >> Manager Plugins" interface.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #5 cPanelMichael, Sep 19, 2017
  6. verdon

    verdon Well-Known Member

    Joined:
    Nov 1, 2003
    Messages:
    862
    Likes Received:
    3
    Trophy Points:
    168
    Location:
    Northern Ontario, Canada
    cPanel Access Level:
    Root Administrator
    I just received this same alert overnight.
    CENTOS 6.9 standard - v66.0.27
    Code:
    # rpm -qa|grep clam
cpanel-clamav-0.99.2-2.cp1164.x86_64
cpanel-clamav-virusdefs-0.99.2-2.cp1164.x86_64
# locate freshclam
 /usr/local/cpanel/3rdparty/bin/freshclam
/usr/local/cpanel/3rdparty/etc/freshclam.conf
/usr/local/cpanel/3rdparty/share/man/man1/freshclam.1
/usr/local/cpanel/3rdparty/share/man/man5/freshclam.conf.5
     
    #6 verdon, Oct 26, 2017
  7. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello @verdon,

    Could you open a support ticket using the link in my signature so we can take a closer look?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #7 cPanelMichael, Oct 27, 2017
  8. verdon

    verdon Well-Known Member

    Joined:
    Nov 1, 2003
    Messages:
    862
    Likes Received:
    3
    Trophy Points:
    168
    Location:
    Northern Ontario, Canada
    cPanel Access Level:
    Root Administrator
    Hi,

    I'm so sorry. I completely missed this reply @cPanelMichael. Is there any point after this amount of time, and an update to v.68. Is there something I can test? I have not received this notification since. Just the one time.
     
    #8 verdon, Nov 7, 2017
  9. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    We could check to make sure there are no rogue copies of ClamAV or FreshClam installed on the system.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #9 cPanelMichael, Nov 7, 2017
  10. verdon

    verdon Well-Known Member

    Joined:
    Nov 1, 2003
    Messages:
    862
    Likes Received:
    3
    Trophy Points:
    168
    Location:
    Northern Ontario, Canada
    cPanel Access Level:
    Root Administrator
    No. Thank you :) Ticket ID 9011467
     
    #10 verdon, Nov 7, 2017
  11. jndawson

    jndawson Well-Known Member

    Joined:
    Aug 27, 2014
    Messages:
    198
    Likes Received:
    20
    Trophy Points:
    18
    Location:
    Western US
    cPanel Access Level:
    DataCenter Provider
    What was the result?
     
    #11 jndawson, Nov 14, 2017
  12. verdon

    verdon Well-Known Member

    Joined:
    Nov 1, 2003
    Messages:
    862
    Likes Received:
    3
    Trophy Points:
    168
    Location:
    Northern Ontario, Canada
    cPanel Access Level:
    Root Administrator
    Only that there were no rogue/extra copies of ClamAV or FreshClam on the system. There had been an update to whm v.68 run on the server since the initial incident, and it's possible that any duplicate was cleaned up then. I suppose it's possible it was just a false positive to begin with as well. I don't know, but it is all good now.
     
    #12 verdon, Nov 16, 2017
  13. PeteS

    PeteS Well-Known Member

    Joined:
    Jun 8, 2017
    Messages:
    99
    Likes Received:
    14
    Trophy Points:
    18
    Location:
    Oregon
    cPanel Access Level:
    Root Administrator
    I have the same message. It showed up in the 5/53 upcp. In the 5/22 upcp clamav updated to 0.99.4-3 and cPanel upgraded to v70.0.43. So it looks like clamav and cPanel updated at the same time, then the next upcp raised this error. Is this a bug in the update? I see the v70.0.44 just updated last night.

    I can run the above checks and do an un/re-install of clamav (then recheck) but I would like to hear the results of more of the tickets that are opened. (The one that reported above seemed to indicate that the above solution was adequate.)

    @cPanelMichael, it would be helpful to have an official report on what this is about and why it (apparently) happens. FYI clamav was only installed on this server through WHM and has been maintained via WHM.

    -Pete
     
    #13 PeteS, May 24, 2018
    Last edited: May 24, 2018
  14. NikRB

    NikRB Registered

    Joined:
    May 21, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Perth, Australia
    cPanel Access Level:
    Root Administrator
    Same alert for me. I installed ClamAV via WHM yesterday on a new server received this message today.
     
    #14 NikRB, May 24, 2018
  15. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello Everyone,

    The Security Advisor State Change notification (configurable in WHM >> Contact Manager) is sent when a change to the state of a security issue is detected as part of the /usr/local/cpanel/scripts/check_security_advice_changes script. This script runs automatically during the cPanel update, and includes an assessment of the freshclam and clanscan versions.

    Based on the reports on this thread, it's possible the ClamAV update that occurs during the cPanel update is not completing successfully or is still in-progress when the check_security_advice_changes script runs. However, I've been unable to reproduce this issue on a test system.

    Could someone facing this issue recently open a support ticket and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #15 cPanelMichael, May 24, 2018
  16. PeteS

    PeteS Well-Known Member

    Joined:
    Jun 8, 2017
    Messages:
    99
    Likes Received:
    14
    Trophy Points:
    18
    Location:
    Oregon
    cPanel Access Level:
    Root Administrator
    Thanks for posting that! I think it's a different scenario (not tied to an update cPanel) that's causing this.

    Can you post which cPanel version you are on now, and whether it was the same version when you installed clamav?

    -Pete
     
    #16 PeteS, May 24, 2018
  17. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello Pete,

    A quick way to verify this is by reviewing the time stamps on the notification history reports:

    Code:
    ls -al /var/cpanel/user_notifications/root/history
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #17 cPanelMichael, May 24, 2018
  18. PeteS

    PeteS Well-Known Member

    Joined:
    Jun 8, 2017
    Messages:
    99
    Likes Received:
    14
    Trophy Points:
    18
    Location:
    Oregon
    cPanel Access Level:
    Root Administrator
    My upcp report for 5/24 reports no issues for /usr/local/cpanel/scripts/check_security_advice_changes.
    • 5/22 upcp updated clamav and cPanel v70.0.43, no clamav error, but reported 2 out of date executables running (possibly clamav?) for which I was unable to determine the process (see: Security Advisor notifications should include process name, not just PID), which may explain the lack of a clamav warning
    • 5/23 upcp reported the clamav error
    • 5/23 upcp updated cPanel to v70.0.44 and reported no clamav error
    It appears to me that it may be related to cPanel updates.

    -Pete
     
    #18 PeteS, May 24, 2018
  19. PeteS

    PeteS Well-Known Member

    Joined:
    Jun 8, 2017
    Messages:
    99
    Likes Received:
    14
    Trophy Points:
    18
    Location:
    Oregon
    cPanel Access Level:
    Root Administrator
    We cross posted... :)

    That's what I did, but using the emails from upcp which gives me more detail on the warnings.

    -Pete
     
    #19 PeteS, May 24, 2018
  20. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    43,672
    Likes Received:
    1,788
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello Pete,

    Could you open a support ticket to report that this continues to happen and post the ticket number here? I'll link the ticket to this forums thread so we can ensure an internal case is opened if necessary.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #20 cPanelMichael, May 24, 2018
(You must log in or sign up to post here.)
Page 1 of 2
Loading...
Similar Threads - [CPANEL 20678] ClamAV
  1. Nirjonadda

    In Progress [CPANEL-21254] cPanel version change from “11.72.0.3” to “” failed during updatenow

    Nirjonadda, Jun 15, 2018 at 9:29 PM, in forum: General Discussion
    Replies:
    7
    Views:
    111
    cPanelLauren
    Jun 18, 2018 at 12:27 PM
  2. akamaras

    In Progress [CPANEL-21026] Include cPanel 70 as LTS version in WHM >> Update Preferences

    akamaras, Jun 15, 2018 at 10:44 AM, in forum: General Discussion
    Replies:
    4
    Views:
    85
    cPanelMichael
    Jun 20, 2018 at 10:59 AM
  3. Mat-d-rat

    [CPANEL-20670] Modify Account fails with previously used domains

    Mat-d-rat, Jun 13, 2018, in forum: General Discussion
    Replies:
    10
    Views:
    116
    Mat-d-rat
    Jun 15, 2018 at 4:24 PM
  4. Edward T.

    In Progress [CPANEL-20537] Reseller cannot restart MySQL

    Edward T., Jun 2, 2018, in forum: General Discussion
    Replies:
    1
    Views:
    85
    cPanelMichael
    Jun 4, 2018
  5. shortguymark

    In Progress [CPANEL-17085] Rearrange Account does not rebuild/restart PHP-FPM configuration

    shortguymark, Jun 2, 2018, in forum: EasyApache
    Replies:
    3
    Views:
    130
    shortguymark
    Jun 4, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice