Re: Malicious .exe in zip file NOT being blocked by banned attachment

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi James,

On 05/14/2015 12:09 AM, James Robertson wrote:
> On 14 May 2015 at 15:49, James Robertson <[email protected] 
> <mailto:[email protected]>> wrote:
> 
> On 29 April 2015 at 18:19, Jason Street <[email protected] 
> <mailto:[email protected]>> wrote:
> 
> On 2015-04-29 03:57, James Robertson wrote:
> 
> A user received an email with a zip file containing a malicious
> .exe.
> 
> 
> 
> Not much help in troubleshooting but the exact same file got passed
> my MAIA install too.
> 
> https://www.virustotal.com/en/file/df67f6033ea1c66792a4116856da4decffcf7bb75dee6e2e7ebcd953cd72d180/analysis/1430295491/
>
>  I do note that ClamAV does not detect it as malicious
> 
> 
> Zip files aren't blocked with a ban on zip files!!
> 
> I added the following configuration to amavis to ban any zip file 
> (truncated for ease of reading in this thread)
> 
> $banned_filename_re = new_RE( qr'^\.(zip)$', );
> 

	Looking at the regex for this, it appears that this is only going to
match a file named ".zip" (or ".(zip)" and not "Reports.zip" (or
anything else that has a character before the ".zip" extension). I
would recommend adding a "|zip|" entry into the list of file
extensions that are already banned (IE: "banned ext - basic" or
"banned ext - long")? That, or change your regex a bit to match
"*.zip" instead:

qr'^.*\.zip$'  (Will match any filename that ends in ".zip")

Regards,
Janky Jay, III

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlVVC+EACgkQGK3MsUbJZn6v9wCfTunsm27OMDeeuEd04wA6a4JC
kUQAnjXJm9xu+dYtmIZG3qADp0ZAnYU1
=GRvo
-----END PGP SIGNATURE-----
_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users