[clamav-users] Error 403 downloading virus updates

[Andrew C Aitchison]

On Thu, 10 Feb 2022, Paul Furnival via clamav-users wrote:

> I am running CLAMAV on a number of servers running different linux
> distributions and, therefore, different versions of the clamav
> engine.  2 of the servers have started to give errors when trying to
> upload the definition files.  These errors came to light as emails I
> received,

> I have tried to update Clamav but there is no newer package for the
> distribution.  It is possible (although I can't prove ite) that
> cloudfare is checking the user agent and seeing my installation is
> too old?

You are correct.

> This is the email that warned me of the problem:
> ===========================================================================
> ERROR: downloadFile: Unexpected response (403) from database.clamav.net/daily-26440.cdiff
> ERROR: getpatch: Can't download daily-26440.cdiff from database.clamav.net/daily-26440.cdiff
> ERROR: downloadFile: Unexpected response (403) from database.clamav.net/daily.cvd
> ERROR: getcvd: Can't download daily.cvd from database.clamav.net/daily.cvd
> ERROR: Update failed for database: daily
> ERROR: Database update process failed: HTTP GET failed (11)
> ERROR: Update failed.
> ===========================================================================
>
>
>
> and this is the output from  freshclam --debug --verbose
> ===========================================================================
> ClamAV update process started at Thu Feb 10 15:21:42 2022
> Current working dir is /var/lib/clamav/
> Querying current.cvd.clamav.net
> TTL: 587
> fc_dns_query_update_info: Software version from DNS: 0.103.5
> WARNING: Your ClamAV installation is OUTDATED!
> WARNING: Local version: 0.102.4 Recommended version: 0.103.5

This is your problem.

> DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav

https://blog.clamav.net/2022/01/clamav-01035-and-01042-security-patch.html
might be more helpfully accurate.

You could host a local mirror
https://docs.clamav.net/appendix/CvdPrivateMirror.html
(includes suggestion of an HTTP proxy)
or run a networked clamd and replace clamscan with clamscan on the problem machines
or even network share /var/lib/clamav/

-- 
Andrew C. Aitchison					Kendal, UK
 			andrew at aitchison.me.uk