Re: Malicious .exe in zip file NOT being blocked by banned attachment

I don't know about anyone else, but I was having trouble with file version 5.22 erring out on various file attachments types on maia 1.0.2c.  Messages would just sit in the postfix queue saying file command had failed on a mime part.  However, file version 5.23 is available here:

ftp://ftp.astron.com/pub/file/

as of yesterday and based on my initial testing, it seems to have fixed this issue.  I highly recommend anyone that was running file 5.22 upgrade to 5.23 as soon as possible.

Thanks,
-Larry


From: Maia-users [mailto:[email protected]] On Behalf Of Lawrence R. Mulder
Sent: Wednesday, May 27, 2015 10:28 PM
To: James Robertson; [email protected]
Subject: Re: [Maia-users] Malicious .exe in zip file NOT being blocked by banned attachment

Which distribution is that on and what version of file did you go from and to with the "upgrade" or replacement?

Thanks,
-Larry


From: James Robertson
Sent: Wednesday, May 27, 2015 10:26 PM
To: [email protected]<mailto:[email protected]>
Subject: Re: [Maia-users] Malicious .exe in zip file NOT being blocked by banned attachment



On 15 May 2015 at 06:56, Janky Jay, III <[email protected]<mailto:[email protected]>> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi James,

On 05/14/2015 12:09 AM, James Robertson wrote:
> On 14 May 2015 at 15:49, James Robertson <[email protected]<mailto:[email protected]>
> <mailto:[email protected]<mailto:[email protected]>>> wrote:
>
> On 29 April 2015 at 18:19, Jason Street <[email protected]<mailto:[email protected]>
> <mailto:[email protected]<mailto:[email protected]>>> wrote:
>
> On 2015-04-29 03:57, James Robertson wrote:
>
> A user received an email with a zip file containing a malicious
> .exe.
>
>
>
> Not much help in troubleshooting but the exact same file got passed
> my MAIA install too.
>
> https://www.virustotal.com/en/file/df67f6033ea1c66792a4116856da4decffcf7bb75dee6e2e7ebcd953cd72d180/analysis/1430295491/
>
>  I do note that ClamAV does not detect it as malicious
>
>
> Zip files aren't blocked with a ban on zip files!!
>
> I added the following configuration to amavis to ban any zip file
> (truncated for ease of reading in this thread)
>
> $banned_filename_re = new_RE( qr'^\.(zip)$', );
>

        Looking at the regex for this, it appears that this is only going to
match a file named ".zip" (or ".(zip)" and not "Reports.zip" (or
anything else that has a character before the ".zip" extension). I
would recommend adding a "|zip|" entry into the list of file
extensions that are already banned (IE: "banned ext - basic" or
"banned ext - long")? That, or change your regex a bit to match
"*.zip" instead:

qr'^.*\.zip$'  (Will match any filename that ends in ".zip")

Regards,
Janky Jay, III

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlVVC+EACgkQGK3MsUbJZn6v9wCfTunsm27OMDeeuEd04wA6a4JC
kUQAnjXJm9xu+dYtmIZG3qADp0ZAnYU1
=GRvo
-----END PGP SIGNATURE-----
_______________________________________________
Maia-users mailing list
[email protected]<mailto:[email protected]>
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

I have resolved this by updating the "file" binary by installing from source from ftp://ftp.astron.com/pub/file/.
These malicious zip files are now correctly identified and blocked.
Thanks

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users