Bug 151826 - silently letting viruses through in case clamd is not (yet) running
Summary: silently letting viruses through in case clamd is not (yet) running
Status: RESOLVED UNMAINTAINED
Alias: None
Product: kmail
Classification: Applications
Component: filtering (show other bugs)
Version: 1.9.5
Platform: Debian testing Linux
: HI normal
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-11-03 22:31 UTC by Olivier Vitrat
Modified: 2015-04-12 10:08 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Olivier Vitrat 2007-11-03 22:31:00 UTC
Version:            (using KDE KDE 3.5.5)
Installed from:    Debian testing/unstable Packages

Reported in Debian BTS at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=435325

Package: kmail
Version: 3.5.5.dfsg.1-6
Severity: important

package clamav-daemon  in version 0.90.1-3etch4 contains program "clamdscan"
package kmail contains program kmail_clamav.sh

if you configure kmail to scan incoming email for viruses, it automatically 
adds filter rules for clamav by using the kmail_clamav.sh script.

when clamd is starting, it takes about 3 minutes until it is running.

so when a typical user starts his computer, loggs in to KDE, starts kmail, 
receives email, then all viruses silently pass through because 
kmail_clamav.sh just sais X-Virus-Flag: No in case clamdscan fails. and 
clamdscan fails in case clamd is not yet running. clamd is not yet running 
because it takes 3 minutes on each first start.

i think it is a fundamental problem with kmail filter scripts that they cannot 
report errors. if you add output to stderr in a kmail filter script and then 
return a error code, if you check the filter log in kmail, you see that the 
filter failed. but if you do not check the log, the filter just silently 
fails.

but it also is not a solution to change kmail_clamav.sh so that if anything 
fails it always adds X-Virus-Flag: Yes.

maybe kmail_clamav.sh should add a big header to the email saying that the 
virus check failed and it is unsure if this email contains a virus or not.


but the current behaviour of just silently passing unchecked data is not 
really good...



thx
cya
erik
Comment 1 Kartik Mistry 2008-04-15 20:06:46 UTC
Can anyone please look at this?
Comment 2 Laurent Montel 2015-04-12 10:08:37 UTC
Thank you for taking the time to file a bug report.

KMail2 was released in 2011, and the entire code base went through significant changes. We are currently in the process of porting to Qt5 and KF5. It is unlikely that these bugs are still valid in KMail2.

We welcome you to try out KMail 2 with the KDE 4.14 release and give your feedback.