[Mimedefang] passing args to clamav through md?

Stephane Lentz Stephane.Lentz at ansf.alcatel.fr
Mon Sep 9 14:08:01 EDT 2002


On Mon, Sep 09, 2002 at 01:24:25PM -0400, David F. Skoll wrote:
> On Mon, 9 Sep 2002, Douglas J Hunley wrote:
> 
> > I've currently got md configured to use clamav. however, I'm
> > wondering how is md telling clamav where to find unzip, unrar,
> > etc...?  I'm betting that it's not.
> 
> You're right.  Clamav doesn't support peeking into zip'd/rar'd/gzip'd
> archives.  All of that is done by Amavis, if you choose to use Amavis.
> 
> MIMEDefang does not support scanning of compressed archives (unless
> the virus-scanner you use automatically looks into archives) and I
> have no plans to add that feature.
> 
The same goes for File::Scan.
The TODO file included mentions : 
- scan compressed files                                                                                                                                              
- more documentation
- more tests

Only some commercial antivirus products are able to scan into archive files
(Zip, tar, gzip, ...) at some point.
McAfee & Trend Interscan belong to this category but I'm not sure they will
handle all kind of archives. A good AV should handle "Zip of Death"/
42.zip like attacks too but it's safer to rely on products such as 
Amavis.

42.zip : http://www.theregister.co.uk/content/56/20322.html

Regards, 

SL/
---
Stephane Lentz / Alcanet International - Internet Services



More information about the MIMEDefang mailing list