James Robertson
2015-04-29 03:57:37 UTC
A user received an email with a zip file containing a malicious .exe.
We block .exe within zip files, however this one got past?
I looked at the file size, it should be scanned as far as I can tell.
I created a bogus .exe zipped it and emailed it to a test user and it
was blocked as expected. I tested using a similiar sized bogus file
and also the exact same file names and those were blocked as well.
It's only these specific files that fail being banned which puzzles me
and I cannot figure out why it allows these files.
I can extract the file fine:
>:/tmp# ls -la Reports.zip
-rw-r--r-- 1 root root 18759 2015-04-28 11:33 Reports.zip
>:/tmp# file Reports.zip
Reports.zip: data
>:/tmp# 7za x Reports.zip
7-Zip (A) 4.58 beta Copyright (c) 1999-2008 Igor Pavlov 2008-05-05
p7zip Version 4.58 (locale=en_AU,Utf16=on,HugeFiles=on,1 CPU)
Processing archive: Reports.zip
Extracting a8924.exe
Everything is Ok
Size: 33792
Compressed: 18759
>:/tmp# ls -la a8924.exe
-rw-r--r-- 1 root root 33792 2015-04-28 03:27 a8924.exe
>:/tmp# file a8924.exe
a8924.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
No errors are reported in amavis logs when the mail arrives other than:
Apr 29 12:09:39 foobaz amavis[15833]: (15833-01) Passed CLEAN,
[123.45.67.89] [123.45.67.89] <***@mydomain> ->
<***@theirdomain>, Message-ID:
<***@foobar>, Hits: -, 391 ms
the amavis config on the Maia machine:
use strict;
$mydomain = 'example.com'; # a convenient default for other settings
$myhostname = 'maia.example.com'; # must be a fully-qualified domain name!
@lookup_sql_dsn = ( ['DBI:mysql:maia:localhost', 'amavis', 'passwd'] );
$max_servers = 4; # number of pre-forked children (2..15 is common)
$daemon_user = 'amavis'; # (no default; customary: vscan or amavis)
$daemon_group = 'amavis'; # (no default; customary: vscan or amavis)
$MYHOME = '/var/lib/amavis'; # a convenient default for other settings
$TEMPBASE = $MYHOME; # working directory
$ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR
$pid_file = "/var/run/amavis/amavisd.pid";
$lock_file = "/var/run/amavis/amavisd.lock";
$QUARANTINEDIR = '/var/lib/amavis/virusmails';
@local_domains_maps = ( [".$mydomain"] );
@mynetworks = qw( 127.0.0.0/8 192.168.1.2 192.168.1.10 );
$policy_bank{'MYNETS'} = { # clients in @mynetworks
bypass_spam_checks_maps => [1], # don't spam-check internal mail
bypass_banned_checks_maps => [1], # don't banned-check internal mail
bypass_header_checks_maps => [1], # don't header-check internal mail
};
$log_level = 0; # verbosity 0..5
$log_recip_templ = undef; # disable by-recipient level-0 log entries
$LOGFILE = "/var/log/amavis.log";
$DO_SYSLOG = 1; # log via syslogd (preferred)
$SYSLOG_LEVEL = 'mail.debug';
$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
$inet_socket_port = 10024; # listen on this local TCP port(s) (see $protocol)
$sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 5.0; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 5.0; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
$sa_mail_body_size_limit = 500*1024; # don't waste time on SA if mail is larger
$sa_local_tests_only = 0; # only tests which do not require internet access?
$sa_auto_whitelist = 0; # turn on AWL in SA 2.63 or older (irrelevant
# for SA 3.0, cf option is 'use_auto_whitelist')
$virus_admin = "mxgadmin\@$mydomain"; # notifications recip.
$banned_admin = "mxgadmin\@$mydomain";
$mailfrom_notify_admin = "mxg\@$mydomain"; # notifications sender
$mailfrom_notify_recip = "mxg\@$mydomain"; # notifications sender
$mailfrom_notify_spamadmin = "mxg\@$mydomain"; # notifications sender
$mailfrom_to_quarantine = ''; # null return path; uses original sender if undef
$warnvirussender = 0;
$warnspamsender = 0;
$warnbannedsender = 1;
$warnvirusrecip = 0;
$warnbannedrecip = 1;
@addr_extension_virus_maps = ('virus');
@addr_extension_spam_maps = ('spam');
@addr_extension_banned_maps = ('banned');
@addr_extension_bad_header_maps = ('badh');
$recipient_delimiter = undef;
$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
$file = '/usr/bin/file'; # file(1) utility; use recent versions
$gzip = 'gzip';
$bzip2 = 'bzip2';
$lzop = 'lzop';
$rpm2cpio = ['rpm2cpio.pl','rpm2cpio'];
$cabextract = 'cabextract';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
$arc = ['nomarch', 'arc'];
$unarj = ['arj', 'unarj'];
$unrar = ['rar', 'unrar'];
$zoo = 'zoo';
$lha = 'lha';
$cpio = ['gcpio','cpio'];
$ar = 'ar';
$dspam = 'dspam';
$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced)
$MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced)
$sa_spam_subject_tag = 'SPAM> ';
$defang_virus = 1; # MIME-wrap passed infected mail
$defang_banned = 1; # MIME-wrap passed mail containing banned name
$notify_method = 'smtp:[127.0.0.1]:10025';
$forward_method = 'smtp:[127.0.0.1]:10025'; # set to undef with milter!
$final_virus_destiny = D_DISCARD;
$final_banned_destiny = D_DISCARD;
$final_spam_destiny = D_DISCARD;
$final_bad_header_destiny = D_DISCARD;
$X_HEADER_TAG = 'X-Virus-Scanned';
$X_HEADER_LINE = "Maia Mailguard 1.0.2";
@viruses_that_fake_sender_maps = (new_RE(
[qr'\bEICAR\b'i => 0], # av test pattern name
[qr'^(WM97|OF97|Joke\.)'i => 0], # adjust names to match your AV scanner
[qr/.*/ => 1], # true for everything else
));
@keep_decoded_original_maps = (new_RE(
qr'^MAIL$', # retain full original message for virus checking (can be slow)
qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
));
@non_malware_viruses_maps = (new_RE(
qr'^(HTML\.Phishing|Phishing)\.',
qr'^MSRBL-(Images|SPAM)\.',
qr'^Sanesecurity\.(Junk|Lott|Phishing|PhishingTestSig|Casino|Bou|Cred|Job|Stk|Loan|Porn|Hdr|Dipl|Spear|Img|Img0|Spam|Spam4|SpamL|SpamImg|Scam|Scam4|ScamL)\.',
));
$banned_filename_re = new_RE(
# block certain double extensions anywhere in the base name
qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
qr'^application/x-msdownload$'i, # block these MIME types
qr'^application/x-msdos-program$'i,
qr'^application/hta$'i,
qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|exe|fxp|hlp|hta|inf|ins|isp|
js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|ops|pcd|pif|prg|
reg|scr|sct|shb|shs|vb|vbe|vbs|wsc|wsf|wsh)$'ix, # banned ext - long
qr'^\.(exe-ms)$', # banned file(1) types
qr'^\.(exe|lha|cab|dll)$', # banned file(1) types
);
@score_sender_maps = ({}); # should be empty if using Maia Mailguard
@av_scanners = (
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
# NOTE: run clamd under the same user as amavisd, or run it under its own
# uid such as clamav, add user clamav to the amavis group, and then add
# AllowSupplementaryGroups to clamd.conf;
# NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
# this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
);
@av_scanners_backup = (
['ClamAV-clamscan', 'clamscan',
"--stdout --disable-summary -r --tempdir=$TEMPBASE {}", [0], [1],
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
1; # insure a defined return
Thanks
James
We block .exe within zip files, however this one got past?
I looked at the file size, it should be scanned as far as I can tell.
I created a bogus .exe zipped it and emailed it to a test user and it
was blocked as expected. I tested using a similiar sized bogus file
and also the exact same file names and those were blocked as well.
It's only these specific files that fail being banned which puzzles me
and I cannot figure out why it allows these files.
I can extract the file fine:
>:/tmp# ls -la Reports.zip
-rw-r--r-- 1 root root 18759 2015-04-28 11:33 Reports.zip
>:/tmp# file Reports.zip
Reports.zip: data
>:/tmp# 7za x Reports.zip
7-Zip (A) 4.58 beta Copyright (c) 1999-2008 Igor Pavlov 2008-05-05
p7zip Version 4.58 (locale=en_AU,Utf16=on,HugeFiles=on,1 CPU)
Processing archive: Reports.zip
Extracting a8924.exe
Everything is Ok
Size: 33792
Compressed: 18759
>:/tmp# ls -la a8924.exe
-rw-r--r-- 1 root root 33792 2015-04-28 03:27 a8924.exe
>:/tmp# file a8924.exe
a8924.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
No errors are reported in amavis logs when the mail arrives other than:
Apr 29 12:09:39 foobaz amavis[15833]: (15833-01) Passed CLEAN,
[123.45.67.89] [123.45.67.89] <***@mydomain> ->
<***@theirdomain>, Message-ID:
<***@foobar>, Hits: -, 391 ms
the amavis config on the Maia machine:
use strict;
$mydomain = 'example.com'; # a convenient default for other settings
$myhostname = 'maia.example.com'; # must be a fully-qualified domain name!
@lookup_sql_dsn = ( ['DBI:mysql:maia:localhost', 'amavis', 'passwd'] );
$max_servers = 4; # number of pre-forked children (2..15 is common)
$daemon_user = 'amavis'; # (no default; customary: vscan or amavis)
$daemon_group = 'amavis'; # (no default; customary: vscan or amavis)
$MYHOME = '/var/lib/amavis'; # a convenient default for other settings
$TEMPBASE = $MYHOME; # working directory
$ENV{TMPDIR} = $TEMPBASE; # environment variable TMPDIR
$pid_file = "/var/run/amavis/amavisd.pid";
$lock_file = "/var/run/amavis/amavisd.lock";
$QUARANTINEDIR = '/var/lib/amavis/virusmails';
@local_domains_maps = ( [".$mydomain"] );
@mynetworks = qw( 127.0.0.0/8 192.168.1.2 192.168.1.10 );
$policy_bank{'MYNETS'} = { # clients in @mynetworks
bypass_spam_checks_maps => [1], # don't spam-check internal mail
bypass_banned_checks_maps => [1], # don't banned-check internal mail
bypass_header_checks_maps => [1], # don't header-check internal mail
};
$log_level = 0; # verbosity 0..5
$log_recip_templ = undef; # disable by-recipient level-0 log entries
$LOGFILE = "/var/log/amavis.log";
$DO_SYSLOG = 1; # log via syslogd (preferred)
$SYSLOG_LEVEL = 'mail.debug';
$enable_db = 1; # enable use of BerkeleyDB/libdb (SNMP and nanny)
$enable_global_cache = 1; # enable use of libdb-based cache if $enable_db=1
$inet_socket_port = 10024; # listen on this local TCP port(s) (see $protocol)
$sa_tag_level_deflt = -999; # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 5.0; # add 'spam detected' headers at that level
$sa_kill_level_deflt = 5.0; # triggers spam evasive actions
$sa_dsn_cutoff_level = 10; # spam level beyond which a DSN is not sent
$sa_mail_body_size_limit = 500*1024; # don't waste time on SA if mail is larger
$sa_local_tests_only = 0; # only tests which do not require internet access?
$sa_auto_whitelist = 0; # turn on AWL in SA 2.63 or older (irrelevant
# for SA 3.0, cf option is 'use_auto_whitelist')
$virus_admin = "mxgadmin\@$mydomain"; # notifications recip.
$banned_admin = "mxgadmin\@$mydomain";
$mailfrom_notify_admin = "mxg\@$mydomain"; # notifications sender
$mailfrom_notify_recip = "mxg\@$mydomain"; # notifications sender
$mailfrom_notify_spamadmin = "mxg\@$mydomain"; # notifications sender
$mailfrom_to_quarantine = ''; # null return path; uses original sender if undef
$warnvirussender = 0;
$warnspamsender = 0;
$warnbannedsender = 1;
$warnvirusrecip = 0;
$warnbannedrecip = 1;
@addr_extension_virus_maps = ('virus');
@addr_extension_spam_maps = ('spam');
@addr_extension_banned_maps = ('banned');
@addr_extension_bad_header_maps = ('badh');
$recipient_delimiter = undef;
$path = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/sbin:/usr/bin:/bin';
$file = '/usr/bin/file'; # file(1) utility; use recent versions
$gzip = 'gzip';
$bzip2 = 'bzip2';
$lzop = 'lzop';
$rpm2cpio = ['rpm2cpio.pl','rpm2cpio'];
$cabextract = 'cabextract';
$uncompress = ['uncompress', 'gzip -d', 'zcat'];
$unfreeze = ['unfreeze', 'freeze -d', 'melt', 'fcat'];
$arc = ['nomarch', 'arc'];
$unarj = ['arj', 'unarj'];
$unrar = ['rar', 'unrar'];
$zoo = 'zoo';
$lha = 'lha';
$cpio = ['gcpio','cpio'];
$ar = 'ar';
$dspam = 'dspam';
$MAXLEVELS = 14;
$MAXFILES = 1500;
$MIN_EXPANSION_QUOTA = 100*1024; # bytes (default undef, not enforced)
$MAX_EXPANSION_QUOTA = 300*1024*1024; # bytes (default undef, not enforced)
$sa_spam_subject_tag = 'SPAM> ';
$defang_virus = 1; # MIME-wrap passed infected mail
$defang_banned = 1; # MIME-wrap passed mail containing banned name
$notify_method = 'smtp:[127.0.0.1]:10025';
$forward_method = 'smtp:[127.0.0.1]:10025'; # set to undef with milter!
$final_virus_destiny = D_DISCARD;
$final_banned_destiny = D_DISCARD;
$final_spam_destiny = D_DISCARD;
$final_bad_header_destiny = D_DISCARD;
$X_HEADER_TAG = 'X-Virus-Scanned';
$X_HEADER_LINE = "Maia Mailguard 1.0.2";
@viruses_that_fake_sender_maps = (new_RE(
[qr'\bEICAR\b'i => 0], # av test pattern name
[qr'^(WM97|OF97|Joke\.)'i => 0], # adjust names to match your AV scanner
[qr/.*/ => 1], # true for everything else
));
@keep_decoded_original_maps = (new_RE(
qr'^MAIL$', # retain full original message for virus checking (can be slow)
qr'^MAIL-UNDECIPHERABLE$', # recheck full mail if it contains undecipherables
qr'^(ASCII(?! cpio)|text|uuencoded|xxencoded|binhex)'i,
));
@non_malware_viruses_maps = (new_RE(
qr'^(HTML\.Phishing|Phishing)\.',
qr'^MSRBL-(Images|SPAM)\.',
qr'^Sanesecurity\.(Junk|Lott|Phishing|PhishingTestSig|Casino|Bou|Cred|Job|Stk|Loan|Porn|Hdr|Dipl|Spear|Img|Img0|Spam|Spam4|SpamL|SpamImg|Scam|Scam4|ScamL)\.',
));
$banned_filename_re = new_RE(
# block certain double extensions anywhere in the base name
qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
qr'^application/x-msdownload$'i, # block these MIME types
qr'^application/x-msdos-program$'i,
qr'^application/hta$'i,
qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046 MIME types
qr'.\.(ade|adp|app|bas|bat|chm|cmd|com|cpl|crt|exe|fxp|hlp|hta|inf|ins|isp|
js|jse|lnk|mda|mdb|mde|mdw|mdt|mdz|msc|msi|msp|mst|ops|pcd|pif|prg|
reg|scr|sct|shb|shs|vb|vbe|vbs|wsc|wsf|wsh)$'ix, # banned ext - long
qr'^\.(exe-ms)$', # banned file(1) types
qr'^\.(exe|lha|cab|dll)$', # banned file(1) types
);
@score_sender_maps = ({}); # should be empty if using Maia Mailguard
@av_scanners = (
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.ctl"],
qr/\bOK$/, qr/\bFOUND$/,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
# NOTE: run clamd under the same user as amavisd, or run it under its own
# uid such as clamav, add user clamav to the amavis group, and then add
# AllowSupplementaryGroups to clamd.conf;
# NOTE: match socket name (LocalSocket) in clamav.conf to the socket name in
# this entry; when running chrooted one may prefer socket "$MYHOME/clamd".
);
@av_scanners_backup = (
['ClamAV-clamscan', 'clamscan',
"--stdout --disable-summary -r --tempdir=$TEMPBASE {}", [0], [1],
qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);
1; # insure a defined return
Thanks
James