Bug 11930 - multi-byte alternate AC filters
multi-byte alternate AC filters
Status: NEW
Product: ClamAV
Classification: ClamAV
Component: libclamav
stable
x86_64 GNU/Linux
: P3 normal
: 0.99.4
Assigned To: ClamAV team
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-10-17 12:19 EDT by Kevin Lin
Modified: 2017-12-15 13:16 EST (History)
3 users (show)

See Also:
QA Contact:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin Lin 2017-10-17 12:19:06 EDT
An issue was reported to the ClamAV users mailing list to state that the signature: Win.Trojan.Dovs-6343034-0 fails to generate a filter.

----Win.Trojan.Dovs-6343034-0
Win.Trojan.Dovs-6343034-0;Target:1;(0|1|3|4)&2;89(4c24|0c)??88d9(8b7424|89)??d3(e6|e2)88d9{-11}0fa5(c7|fa|c6){-3}f6c3200f45(fe|d6|f2)0f45(f0|f1|d0);8b4424??8b(74|54)24??0fa5(f0|d0)*d3(e6|e2)31(db|f6|ff)f6(c1|c2)200f45(c6|c2)0f45(f3|d6|f7);5c726567656469742e657865;6d636971747a33322e646c6c;7162316a786c4545
----

----clamscan -ir
LibClamAV Warning: Don't know how to create filter for: Win.Trojan.Dovs-6343034-0
LibClamAV Warning: cli_ac_addpatt: cannot use filter for trie
----

The issue ultimately is that the filter system is unable to handle alternates consisting of sequences with two or more bytes, affecting both fixed multi-byte and variable alternates.

The effected code is found at libclamav/filtering.c:(491 in 0.99.2).

Note that while issue is noisy, it does not affect detection beyond whatever filters are doing with the pattern.