[Kolab-devel] [issue2794] amavisd forgets virus name if mail contains more than one virus

[Thomas Arendsen Hein]

New submission from Thomas Arendsen Hein <thomas at intevation.de>:

Tested with clamav-0.93-20080414 and clamav-0.93.1-20080610 with a fresh
installation of Kolab Server 2.2-rc3.

An email with two attachments: clam-v2.rar (from clamav-testfiles) and eicar.com
(standard eicar test file) causes the following entry in amavisd.log:

Jun 18 14:31:09 burlywood1.rgb /kolab/sbin/amavisd[20492]: (20492-01)
Not-Delivered, <1 at burlywood1.rgb> -> <1 at burlywood1.rgb>, quarantine
UDxeEvRmOse6, Message-ID: <200806181432.10188.1 at burlywood1.rgb>, Hits: -
Jun 18 14:31:09 burlywood1.rgb /kolab/sbin/amavisd[20492]: (20492-01) Blocked
INFECTED (), <1 at burlywood1.rgb> -> <1 at burlywood1.rgb>, Hits: -, tag=3, tag2=3,
kill=3, L/0/0/0

The virus name should be noted in the "INFECTED ()" part, but isn't.

The sender received an email:
Subject: Unknown problem IN MAIL FROM YOU
Body starts with:
Our content checker found
in email presumably from you (<1 at burlywood1.rgb>),

With only one attachment the mail reads:
Subject: VIRUS (ClamAV-Test-File) IN MAIL FROM YOU
Body starts with:
VIRUS ALERT

Our content checker found
    virus: ClamAV-Test-File
in email presumably from you (<1 at burlywood1.rgb>),


With Kolab Server 2.1 (i.e. older amavisd, but current clamav) the log contains
two virus names if two were found, e.g.: Exploit.HTML.IFrame, Worm.SomeFool.P

With one production installation of Kolab Server 2.2-rc2 and updated clamav only
one virus name is shown in mail and log when clamav/eicar test files are sent.

----------
assignedto: thomas
messages: 15226
nosy: bernhard, martin, thomas, till, wilde, wrobel
priority: bug
status: unread
title: amavisd forgets virus name if mail contains more than one virus
topic: server
___________________________________________________
Kolab issue tracker <kolab-issues at intevation.de>
<https://www.intevation.de/roundup/kolab/issue2794>
___________________________________________________