Sophos Anti-Virus for Mac OS X release notes

Product version	: 4.9.12
Threat detection engine version	: 2.75.2
Threat data version	: 4.31, July 2008

www.sophos.com

Contents

New in this version
Known problems with this version
Additional information
Information from previous versions
Copyright and licensing information for ACE™, TAO™, CIAO™, and CoSMIC™
Copyright and licensing information for OpenSSL and SSLeay

New in this version

• The threat detection engine and threat data have been updated.

Known problems with this version

• (DEF 19925) On OS X 10.5.x with FileVault enabled, the on-access scanner can cause deadlocks.

• On OS X 10.4, if the immediate scanner moves or copies an infected file to a quarantine folder, the action is intercepted by the on-access scanner. This is because Spotlight indexes the quarantine folder when a file is quarantined there. To work around this, in the Spotlight preferences, put the quarantine folder into the list of excluded folders.

• If you make any of the following configuration changes in the Sophos Anti-Virus updating preferences pages, they do not trigger a “differs from policy” alert in Sophos Enterprise Console:

• Disable updating from a secondary server.
• Set the primary or secondary proxy to either “Use system proxy settings” or “Do not use proxy”.

• On Intel-based Macs, if you click the Sophos Anti-Virus icon in the system status bar, and select “About Sophos Anti-Virus”, the “About” box is always displayed behind the frontmost window. 

• On computers running Mac OS X 10.4.0–10.4.2 and Sophos Anti-Virus, in some circumstances the computer can become locked. This can happen if Sophos Anti-Virus has been installed from a central installation directory that is being updated by Sophos Enterprise Console or Sophos Control Center. A component of Sophos Anti-Virus, the Remote Management System, which is installed on the workstation, can trigger a bug in Mac OS X. If the affected computer is disconnected from the network, it can become locked.

   This problem has been investigated by Apple, and has been fixed in Mac OS X 10.4.3. For information on how to work around this problem in Mac OS X 10.4.0–10.4.2, refer to Sophos support knowledgebase article 13241.

• When installing Sophos Anti-Virus from a server onto a Macintosh running Mac OS X 10.3, an error message may be displayed saying that you cannot run the installer from a network volume. This happens because Mac OS X 10.3 implements file permissions differently to previous versions of Mac OS X when accessing SMB network shares. If this occurs, copy the installer package locally and install it in the usual way.

• When Sophos Anti-Virus auto-mounts a Windows server volume during an update or whilst sending an InterCheck Server message, the server is occasionally left mounted following completion of the action. This will not cause any problems with subsequent updates or messages. If desired the volume can be manually unmounted.

• When you specify the server from which Sophos Anti-Virus will be updated, you cannot use an account with a blank password.

You specify the server from which Sophos Anti-Virus will be updated, and the account used to access it, in the “Primary Server” or “Secondary Server” tabbed page (to reach these pages, you open the “Sophos Anti-Virus” system preferences pages, click the “AutoUpdate” tab and select “Network Settings”). If this server is a Windows network volume, you cannot specify an account with a blank password.

If the Windows network volume allows guest access, you can leave both the username and password fields blank. Otherwise, you must enter a username and a password.

• If you configure Sophos Anti-Virus to scan inside archive files, and it attempts to scan inside a WinZip version 8 self-extractor, Sophos Anti-Virus may report that it can’t read the file or that it is part of a multi-volume archive. However, Sophos Anti-Virus still detects viruses correctly in such self-extractors, and doesn’t prevent access to clean files that are contained in them.

• The virus data version is displayed instead of the product version in the following places:

• the on-screen log in the “Sophos Anti-Virus” window
• the “About” box that is displayed by selecting “About Sophos Anti-Virus” from the “Sophos Anti-Virus” menu.

Additional information

• In Enterprise Console and Sophos Control Center, you can set up email alerting for “Virus alerts”, “Scanning errors” or “Other errors”. Mac OS X computers do not support the “Scanning errors” option and therefore do not send these alerts.

Information from previous versions

4.9.11

• (SUG 21125) The startup scripts now validate the state of the computer before trying to start the on-access scanner.

• (DEF 21124, SUG 21130) Files that were created by Sophos Anti-Virus in /tmp are now created in /var/run instead.

• (DEF 21427) MIME scanning has been improved.

4.9.10

• (DEF 20389) This version includes a fix for a problem with the reporting of virus identity files to Sophos Enterprise Console and Sophos Control Center.

• (DEF 20284) The man page for sweep, the command-line version of Sophos Anti-Virus, is now installed as well.

• (DEF 19512) Prior to this release, a small number of sweep command-line options (for example, -ns and -ss) were not reported when sweep displayed “Command line qualifiers” before scanning. This is now corrected.

• Improved atime management for scanned files

  (DEF 16689) This version of sweep enables more control of how it affects the access time (atime) of files that it scans. The existing command-line options --reset-atime and --no-reset-atime have been extended to enable you to specify files or directories on which the atime should or should not be reset.

  Usage is as follows:

    --reset-atime=<obj1>,<obj2>,...,<objn>,...
    --no-reset-atime=<obj1>,<obj2>,...,<objn>,...

  where <obj1>, <obj2>, and <objn> are files or directories. If you specify a directory, the action applies to all files and directories underneath that directory.

  If you don't specify any files or directories, --reset-atime and --no-reset-atime apply to all files that are being scanned, as before.

  The default behaviour of sweep is still that it resets the atime on all files and directories that are being scanned.

Copyright and licensing information for ACE™, TAO™, CIAO™, and CoSMIC™

[1]ACE™, [2]TAO™, [3]CIAO™, and [4]CoSMIC™ (henceforth referred to as “DOC software”) are copyrighted by [5]Douglas C. Schmidt and his [6]research group at [7]Washington University, [8]University of California, Irvine, and [9]Vanderbilt University, Copyright © 1993–2005, all rights reserved. Since DOC software is [10]open-source, free software, you are free to use, modify, copy, and distribute–perpetually and irrevocably–the DOC software source code and object code produced from the source, as well as copy and distribute modified versions of this software. You must, however, include this copyright statement along with code built using DOC software.

You can use DOC software in commercial and/or binary software releases and are under no obligation to redistribute any of your source code that is built using DOC software. Note, however, that you may not do anything to the DOC software code, such as copyrighting it yourself or claiming authorship of the DOC software code, that will prevent DOC software from being distributed freely using an open-source development model. You needn’t inform anyone that you’re using DOC software in your software, though we encourage you to let [11]us know so we can promote your project in the [12]DOC software success stories.

DOC software is provided as is with no warranties of any kind, including the warranties of design, merchantability, and fitness for a particular purpose, noninfringement, or arising from a course of dealing, usage or trade practice. Moreover, DOC software is provided with no support and without any obligation on the part of Washington University, UC Irvine, Vanderbilt University, their employees, or students to assist in its use, correction, modification, or enhancement. A [13]number of companies around the world provide commercial support for DOC software, however. DOC software is Y2K-compliant, as long as the underlying OS platform is Y2K-compliant.

Washington University, UC Irvine, Vanderbilt University, their employees, and students shall have no liability with respect to the infringement of copyrights, trade secrets or any patents by DOC software or any part thereof. Moreover, in no event will Washington University, UC Irvine, or Vanderbilt University, their employees, or students be liable for any lost revenue or profits or other special, indirect and consequential damages.

The [14]ACE, [15]TAO, [16]CIAO, and [17]CoSMIC web sites are maintained by the [18]DOC Group at the [19]Institute for Software Integrated Systems (ISIS) and the [20]Center for Distributed Object Computing of Washington University, St. Louis for the development of open-source software as part of the [21]open-source software community. By submitting comments, suggestions, code, code snippets, techniques (including that of usage), and algorithms, submitters acknowledge that they have the right to do so, that any such submissions are given freely and unreservedly, and that they waive any claims to copyright or ownership. In addition, submitters acknowledge that any such submission might become part of the copyright maintained on the overall body of code, which comprises the DOC software. By making a submission, submitter agree to these terms. Furthermore, submitters acknowledge that the incorporation or modification of such submissions is entirely at the discretion of the moderators of the open-source DOC software projects or their designees.

The names ACE™, TAO™, CIAO™, CoSMIC™, Washington University, UC Irvine, and Vanderbilt University, may not be used to endorse or promote products or services derived from this source without express written permission from Washington University, UC Irvine, or Vanderbilt University. Further, products or services derived from this source may not be called ACE™, TAO™, CIAO™, or CoSMIC™ nor may the name Washington University, UC Irvine, or Vanderbilt University appear in their names, without express written permission from Washington University, UC Irvine, and Vanderbilt University.

If you have any suggestions, additions, comments, or questions, please let [22]me know.

[23]Douglas C. Schmidt

The ACE home page is http://www.cs.wustl.edu/ACE.html.

Last modified 21:26:22 CST 03 November 2003

References

  1. http://www.cs.wustl.edu/~schmidt/ACE.html
  2. http://www.cs.wustl.edu/~schmidt/TAO.html
  3. http://www.dre.vanderbilt.edu/CIAO/
  4. http://www.dre.vanderbilt.edu/cosmic/
  5. http://www.dre.vanderbilt.edu/~schmidt/
  6. http://www.cs.wustl.edu/~schmidt/ACE-members.html
  7. http://www.wustl.edu/
  8. http://www.uci.edu/
  9. http://www.vanderbilt.edu/
10. http://www.the-it-resource.com/Open-Source/Licenses.html
11. mailto:doc_group@cs.wustl.edu
12. http://www.cs.wustl.edu/~schmidt/ACE-users.html
13. http://www.cs.wustl.edu/~schmidt/commercial-support.html
14. http://www.cs.wustl.edu/~schmidt/ACE.html
15. http://www.cs.wustl.edu/~schmidt/TAO.html
16. http://www.dre.vanderbilt.edu/CIAO/
17. http://www.dre.vanderbilt.edu/cosmic/
18. http://www.dre.vanderbilt.edu/
19. http://www.isis.vanderbilt.edu/
20. http://www.cs.wustl.edu/~schmidt/doc-center.html
21. http://www.opensource.org/
22. mailto:d.schmidt@vanderbilt.edu
23. http://www.dre.vanderbilt.edu/~schmidt/

Copyright and licensing information for OpenSSL and SSLeay

The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact 
openssl-core@openssl.org.

OpenSSL License

Copyright © 1998–2006 The OpenSSL Project. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgment: “This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (http://www.openssl.org/)”

4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact 
openssl-core@openssl.org.

5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.

6. Redistributions of any form whatsoever must retain the following acknowledgment: “This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit 
(http://www.openssl.org/)”

THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS” AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).

Original SSLeay License

Copyright © 1995–1998 Eric Young (eay@cryptsoft.com) All rights reserved.

This package is an SSL implementation written by Eric Young (eay@cryptsoft.com). The implementation was written so as to conform with Netscapes SSL.

This library is free for commercial and non-commercial use as long as the following conditions are aheared to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com).

Copyright remains Eric Young’s, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

3. All advertising materials mentioning features or use of this software must display the following acknowledgement: “This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)” The word “cryptographic” can be left out if the rouines from the library being used are not cryptographic related :-).

4. If you include any Windows specific code (or a derivative thereof) from the apps directory (application code) you must include an acknowledgement: “This product includes software written by Tim Hudson (tjh@cryptsoft.com)”

THIS SOFTWARE IS PROVIDED BY ERIC YOUNG “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The licence and distribution terms for any publically available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution licence (including the GNU Public Licence.)