Alioth's Journal: Debian users are without ClamAV - mail servers broken

Well, this morning I found my mail server had died. Postfix was up just fine, but the logs showed that it was failing while passing messages via clamav.

ClamAV was complaining about a bad daily.clv file, and looking at clamav's website... oops, the version of ClamAV in debian-stable has been *disabled* deliberately by ClamAV! (The issue: that version uses too much bandwidth when updating its AV database and ClamAV can no longer tolerate the bandwidth usage).

Oops. Any Debian mail server that passes mail through ClamAV is currently down, unless the admin already knew of this and compiled a new ClamAV or uses Debian unstable.

Looking at sendbug, Debian have been informed... I don't see any information about when we'll get a new ClamAV package, so it's time to compile the latest from source.

Fun, fun

[Qzukk]

Debian didn't do enough (did they do anything?) to educate the public, but clamav was basically why debian-volatile exists: packages that changed too fast to ever be stable but where trying to pin the package to an old version would be either unsupportable or insecurable.

http://www.debian.org/volatile/ [debian.org]
http://packages.debian.org/search?suite=lenny-volatile&searchon=names&keywords=clamav [debian.org]