Trojan warning on Shibboleth Windows installation

[Jason Lee]

Hi, Scott

Thanks a lot for your very prompting answer, we uploaded the installer to
virustotal and almost all other anti-viruses considered it safe, so we
decided to report it to NOD32 as a case of false positive and hopefully get
it off the 'naughty list'.

Jason

On 1 February 2012 18:44, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/31/12 5:52 PM, "Jason Lee" <asktheitguy at gmail.com> wrote:
>
> >When we are installing the latest Shibboleth SP (2.4.3) on our Windows
> >Server 2008, we revived a warning message from local NOD32 Antivirus
> >saying it contains a variant of Win32/Agent.DNQAVIY Trojan. We ignored it
> >and proceed to completion, but was hit by another warning message from
> >NOD32 saying \shibboleth-sp\bin\debug\txfmout.exe is probably a variant
> >of Win32/Agent.DNQAVIY Trojan blah blah, so we had to uninstall it; then
> >we tried version 2.4.2 on which NOD doesn't give us any warning this
> >time. However we have other severs in the same cluster running SP 2.4.3
> >(we installed them a month ago and no Antivirus warning what-so-ever).
>
> Well, I don't know what to tell you, but I can't reproduce that (I've
> tried on several occasions at different times). I have no evidence that
> it's anything but a false positive. We plan to take steps in future
> releases to clean room the builds, but I don't think it's going to stop
> this.
>
> >So, would it be OK to have machines in same cluster (behind load balance
> >but no sticky sessions) running slight different version of Shibboleth
> >SPs? Also does any other Shibboleth&NOD32 users suffer the same Trojan
> >warning problem?
>
> Check the security advisories and then strongly reconsider running 2.4.2.
> If you can't trust the software, don't run it or build it yourself. But
> don't run a hackable version instead.
>
> To answer the question, non-sticky sessions implies a shared shibd. That
> is not supported and will not work reliably if you mix versions. I make no
> comment about any specific mix of versions. It may or may not work, and I
> won't do any investigating to determine whether it will. Non-shared
> deployments with mixed versions are not supported, but are mostly likely
> to work.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120202/69775c8c/attachment.html