Re: Malicious .exe in zip file NOT being blocked by banned attachment

On 29 April 2015 at 18:19, Jason Street <[email protected]> wrote:

> On 2015-04-29 03:57, James Robertson wrote:
>
>> A user received an email with a zip file containing a malicious .exe.
>>
>
>
> Not much help in troubleshooting but the exact same file got passed my
> MAIA install too.
>
>
> https://www.virustotal.com/en/file/df67f6033ea1c66792a4116856da4decffcf7bb75dee6e2e7ebcd953cd72d180/analysis/1430295491/
>
> I do note that ClamAV does not detect it as malicious
>

Zip files aren't blocked with a ban on zip files!!

I added the following configuration to amavis to ban any zip file
(truncated for ease of reading in this thread)

$banned_filename_re = new_RE(
qr'^\.(zip)$',
);

I tested using a bogus zip file and it banned it as expected.  But if I use
the malicious .zip it bypasses amavis???

Client is getting annoyed as we told them we had banned all .zip's as they
have still been getting hammered by variants of this email.

This is a excerpt just now for a test I did with the banned zip rule in
place.  The Reports.zip file was allowed.

root@suumxg:~# grep 08888-05 /var/log/mail.log | grep -i reports.zip
May 14 15:33:36 suumxg amavis[8888]: (08888-05) p003 1/2 Content-Type:
application/octet-stream, size: 18759 B, name: Reports.zip
May 14 15:33:36 suumxg amavis[8888]: (08888-05) check_for_banned (p003)
N=Reports.zip
May 14 15:33:36 suumxg amavis[8888]: (08888-05) lookup (banned_filename) =>
undef, "Reports.zip" does not match
May 14 15:33:36 suumxg amavis[8888]: (08888-05) lookup (banned_namepath_re)
=> undef,
"P=p004\tL=1\tM=multipart/mixed\nP=p003\tL=1/2\tM=application/octet-stream\tT=dat\tN=Reports.zip"
does not match
May 14 15:33:36 suumxg amavis[8888]: (08888-05) p.path:
"P=p004,L=1,M=multipart/mixed |
P=p003,L=1/2,M=application/octet-stream,T=dat,N=Reports.zip"

Any ideas on how to fix this?

James

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users