Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False negative due to container cache bug #1221

Open
elceef opened this issue Mar 30, 2024 · 0 comments
Open

False negative due to container cache bug #1221

elceef opened this issue Mar 30, 2024 · 0 comments

Comments

@elceef
Copy link

elceef commented Mar 30, 2024 •
edited

Describe the bug

Logical signatures that have conditions on a Container type or Intermediates types may not match if the target file is processed (normalized, extracted additional data) and scanned outside of the container first, and cached as clean.

How to reproduce the problem

$ sudo clamdscan -V
ClamAV 1.0.5

With the following proof-of-concept signatures matching string <input inside container:

HtmlContainerTestSig;Engine:81-255,Container:CL_TYPE_ZIP,Target:3;0;3c696e70757420
#HtmlIntermediatesTestSig;Engine:81-255,Intermediates:CL_TYPE_ZIP,Target:3;0;3c696e70757420

ZIP archive can't be detected anymore after the HTML file was scanned and cached as clean.

$ cat sample.html 
<html>
<body>
<input type="password" />
</body>
</html>
$ zip sample.zip sample.html
  adding: sample.html (deflated 18%)
$ sudo clamdscan --fdpass /tmp/sample.zip --no-summary
/tmp/sample.zip: HtmlContainerTestSig.UNOFFICIAL FOUND
$ sudo clamdscan --fdpass /tmp/sample.html --no-summary
/tmp/sample.html: OK
$ sudo clamdscan --fdpass /tmp/sample.zip --no-summary
/tmp/sample.zip: OK

Attachments

Attaching samples and logical signatures demonstrated above for convenience.
files.zip
@elceef elceef changed the title Container cache bug for HTML normalized files False negative due to container cache bug Apr 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@elceef