[Mimedefang] patch to add blocking of encrypted email via uvscan
Lucas Albers
admin at cs.montana.edu
Sun Dec 7 13:58:09 EST 2003
Thought I would give a little back.
Currently clamscan,f-prot will decrypt password protected zip files, and
detect virus.
Mcafee will not.
Attached is a diff that adds that support in for 2.39, if
block_encrypted_zip is true uvscan will block encrypted zip files.
So someone has to specifically configure uvscan to block encrypted zip
files. The default behavior will still remain to not block encrypted
files.
diff -d -c mimedefang-2.39/mimedefang.pl
mimedefang-2.39/mimedefang.pl.decrypt
*** mimedefang-2.39/mimedefang.pl Sun Dec 7 11:15:42 2003
--- mimedefang-2.39/mimedefang.pl.decrypt Sun Dec 7 11:48:26 2003
***************
*** 145,150 ****
--- 145,153 ----
$ClamdSock = "@SPOOLDIR@/clamd.sock";
$TrophieSock = "@SPOOLDIR@/trophie";
+ #nai will block encrypted zip files,default is no.
+ $block_encrypted_zip = 0;
+
package MIME::Parser::ParanoidFiler;
use vars qw(@ISA);
***************
*** 2180,2185 ****
--- 2183,2194 ----
$VirusName = "unknown-NAI-virus" if $VirusName eq "";
return ($code, 'virus', 'quarantine');
}
+ # encrypted file
+ if ($code == 0 && $block_encrypted_zip == 1) {
+ if ($CurrentVirusScannerMessage =~ m/^\s+is password-protected\./);
+ $VirusName = "encrypted" if $VirusName eq "";
+ return ($code, 'virus', 'quarantine');
+ }
# Self-check failed
return ($code, 'swerr', 'tempfail') if ($code == 19);
More information about the MIMEDefang
mailing list