Re: Malicious .exe in zip file NOT being blocked by banned attachment

Which distribution is that on and what version of file did you go from and to with the "upgrade" or replacement?

Thanks,
-Larry


________________________________________________
Lawrence R. Mulder / RHCE, VTSP, SEC+
Vice President, InformAbility, Inc.
lmulder-iL7gtBVyNKCGUxFv0Br65wC/[email protected]
http://www.informability.com/about
http://www.facebook.com/InformAbility
Ph: 630-532-5941
Fx: 630-532-5955
________________________________________________
From: James Robertson
Sent: Wednesday, May 27, 2015 10:26 PM
To: [email protected]
Subject: Re: [Maia-users] Malicious .exe in zip file NOT being blocked by banned attachment



On 15 May 2015 at 06:56, Janky Jay, III <[email protected]<mailto:[email protected]>> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi James,

On 05/14/2015 12:09 AM, James Robertson wrote:
> On 14 May 2015 at 15:49, James Robertson <[email protected]<mailto:[email protected]>
> <mailto:[email protected]<mailto:[email protected]>>> wrote:
>
> On 29 April 2015 at 18:19, Jason Street <[email protected]<mailto:[email protected]>
> <mailto:[email protected]<mailto:[email protected]>>> wrote:
>
> On 2015-04-29 03:57, James Robertson wrote:
>
> A user received an email with a zip file containing a malicious
> .exe.
>
>
>
> Not much help in troubleshooting but the exact same file got passed
> my MAIA install too.
>
> https://www.virustotal.com/en/file/df67f6033ea1c66792a4116856da4decffcf7bb75dee6e2e7ebcd953cd72d180/analysis/1430295491/
>
>  I do note that ClamAV does not detect it as malicious
>
>
> Zip files aren't blocked with a ban on zip files!!
>
> I added the following configuration to amavis to ban any zip file
> (truncated for ease of reading in this thread)
>
> $banned_filename_re = new_RE( qr'^\.(zip)$', );
>

        Looking at the regex for this, it appears that this is only going to
match a file named ".zip" (or ".(zip)" and not "Reports.zip" (or
anything else that has a character before the ".zip" extension). I
would recommend adding a "|zip|" entry into the list of file
extensions that are already banned (IE: "banned ext - basic" or
"banned ext - long")? That, or change your regex a bit to match
"*.zip" instead:

qr'^.*\.zip$'  (Will match any filename that ends in ".zip")

Regards,
Janky Jay, III

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlVVC+EACgkQGK3MsUbJZn6v9wCfTunsm27OMDeeuEd04wA6a4JC
kUQAnjXJm9xu+dYtmIZG3qADp0ZAnYU1
=GRvo
-----END PGP SIGNATURE-----
_______________________________________________
Maia-users mailing list
[email protected]<mailto:[email protected]>
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users


I have resolved this by updating the "file" binary by installing from source from ftp://ftp.astron.com/pub/file/.

These malicious zip files are now correctly identified and blocked.

Thanks

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users