[Mimedefang] patch to add blocking of encrypted email via uvscan

Lucas Albers admin at cs.montana.edu
Sun Dec 7 13:58:09 EST 2003


Thought I would give a little back.
Currently clamscan,f-prot will decrypt password protected zip files, and
detect virus.
Mcafee will not.
Attached is a diff that adds that support in for 2.39, if
block_encrypted_zip is true uvscan will block encrypted zip files.
So someone has to specifically configure uvscan to block encrypted zip
files. The default behavior will still remain to not block encrypted
files.

diff -d -c mimedefang-2.39/mimedefang.pl
mimedefang-2.39/mimedefang.pl.decrypt
*** mimedefang-2.39/mimedefang.pl       Sun Dec  7 11:15:42 2003
--- mimedefang-2.39/mimedefang.pl.decrypt       Sun Dec  7 11:48:26 2003
***************
*** 145,150 ****
--- 145,153 ----
  $ClamdSock  = "@SPOOLDIR@/clamd.sock";
  $TrophieSock = "@SPOOLDIR@/trophie";

+ #nai will block encrypted zip files,default is no.
+ $block_encrypted_zip = 0;
+
  package MIME::Parser::ParanoidFiler;

  use vars qw(@ISA);
***************
*** 2180,2185 ****
--- 2183,2194 ----
        $VirusName = "unknown-NAI-virus" if $VirusName eq "";
        return ($code, 'virus', 'quarantine');
      }
+     # encrypted file
+     if ($code == 0 && $block_encrypted_zip == 1) {
+       if ($CurrentVirusScannerMessage =~ m/^\s+is password-protected\./);
+         $VirusName = "encrypted" if $VirusName eq "";
+         return ($code, 'virus', 'quarantine');
+     }

      # Self-check failed
      return ($code, 'swerr', 'tempfail') if ($code == 19);








More information about the MIMEDefang mailing list