Re: Malicious .exe in zip file NOT being blocked by banned attachment

On 14 May 2015 at 15:49, James Robertson <[email protected]> wrote:

> On 29 April 2015 at 18:19, Jason Street <[email protected]> wrote:
>
>> On 2015-04-29 03:57, James Robertson wrote:
>>
>>> A user received an email with a zip file containing a malicious .exe.
>>>
>>
>>
>> Not much help in troubleshooting but the exact same file got passed my
>> MAIA install too.
>>
>>
>> https://www.virustotal.com/en/file/df67f6033ea1c66792a4116856da4decffcf7bb75dee6e2e7ebcd953cd72d180/analysis/1430295491/
>>
>> I do note that ClamAV does not detect it as malicious
>>
>
> Zip files aren't blocked with a ban on zip files!!
>
> I added the following configuration to amavis to ban any zip file
> (truncated for ease of reading in this thread)
>
> $banned_filename_re = new_RE(
> qr'^\.(zip)$',
> );
>
> I tested using a bogus zip file and it banned it as expected.  But if I
> use the malicious .zip it bypasses amavis???
>
> Client is getting annoyed as we told them we had banned all .zip's as they
> have still been getting hammered by variants of this email.
>
> This is a excerpt just now for a test I did with the banned zip rule in
> place.  The Reports.zip file was allowed.
>
> root@suumxg:~# grep 08888-05 /var/log/mail.log | grep -i reports.zip
> May 14 15:33:36 suumxg amavis[8888]: (08888-05) p003 1/2 Content-Type:
> application/octet-stream, size: 18759 B, name: Reports.zip
> May 14 15:33:36 suumxg amavis[8888]: (08888-05) check_for_banned (p003)
> N=Reports.zip
> May 14 15:33:36 suumxg amavis[8888]: (08888-05) lookup (banned_filename)
> => undef, "Reports.zip" does not match
> May 14 15:33:36 suumxg amavis[8888]: (08888-05) lookup
> (banned_namepath_re) => undef,
> "P=p004\tL=1\tM=multipart/mixed\nP=p003\tL=1/2\tM=application/octet-stream\tT=dat\tN=Reports.zip"
> does not match
> May 14 15:33:36 suumxg amavis[8888]: (08888-05) p.path:
> "P=p004,L=1,M=multipart/mixed |
> P=p003,L=1/2,M=application/octet-stream,T=dat,N=Reports.zip"
>
> Any ideas on how to fix this?
>
> James
>
>
>
>
On my system this is what file shows for the bogus and malicious
(Reports.zip) zip files.  It looks like it cannot identify Reports.zip as a
zip archive.

>:/tmp# file /tmp/bogus.zip
/tmp/bogus.zip: Zip archive data, at least v2.0 to extract
>:/tmp# file /tmp/Reports.zip
/tmp/Reports.zip: data

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users