Re: Malicious .exe in zip file NOT being blocked by banned attachment

On 15 May 2015 at 06:56, Janky Jay, III <[email protected]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi James,
>
> On 05/14/2015 12:09 AM, James Robertson wrote:
> > On 14 May 2015 at 15:49, James Robertson <[email protected]
> > <mailto:[email protected]>> wrote:
> >
> > On 29 April 2015 at 18:19, Jason Street <[email protected]
> > <mailto:[email protected]>> wrote:
> >
> > On 2015-04-29 03:57, James Robertson wrote:
> >
> > A user received an email with a zip file containing a malicious
> > .exe.
> >
> >
> >
> > Not much help in troubleshooting but the exact same file got passed
> > my MAIA install too.
> >
> >
> https://www.virustotal.com/en/file/df67f6033ea1c66792a4116856da4decffcf7bb75dee6e2e7ebcd953cd72d180/analysis/1430295491/
> >
> >  I do note that ClamAV does not detect it as malicious
> >
> >
> > Zip files aren't blocked with a ban on zip files!!
> >
> > I added the following configuration to amavis to ban any zip file
> > (truncated for ease of reading in this thread)
> >
> > $banned_filename_re = new_RE( qr'^\.(zip)$', );
> >
>
>         Looking at the regex for this, it appears that this is only going
> to
> match a file named ".zip" (or ".(zip)" and not "Reports.zip" (or
> anything else that has a character before the ".zip" extension). I
> would recommend adding a "|zip|" entry into the list of file
> extensions that are already banned (IE: "banned ext - basic" or
> "banned ext - long")? That, or change your regex a bit to match
> "*.zip" instead:
>
> qr'^.*\.zip$'  (Will match any filename that ends in ".zip")
>
> Regards,
> Janky Jay, III
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iEYEARECAAYFAlVVC+EACgkQGK3MsUbJZn6v9wCfTunsm27OMDeeuEd04wA6a4JC
> kUQAnjXJm9xu+dYtmIZG3qADp0ZAnYU1
> =GRvo
> -----END PGP SIGNATURE-----
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>


I have resolved this by updating the "file" binary by installing from
source from ftp://ftp.astron.com/pub/file/.

These malicious zip files are now correctly identified and blocked.

Thanks

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users