[prev in list] [next in list] [prev in thread] [next in thread] 

List:       clamav-users
Subject:    Re: [clamav-users] scanning mp3-files with clamscan
From:       Steven Morgan <smorgan () sourcefire ! com>
Date:       2017-07-18 16:39:50
Message-ID: CAH-jhOCUSpm346CmR7tZ+Wf6PRvg0L5zM8=EAhpD+4QiO0C71g () mail ! gmail ! com
[Download RAW message or body]

Paul,

I don't know how an MP3 file would contain malware, other than possible
exploits of MP3 player/processor flaws.

If you want to have MP3 files scanned anyway, it is possible to change the
file type signatures for MP3 so they are not ignored. Also, I don't know of
any signatures for MP3.

Steve

On Mon, Jul 17, 2017 at 11:45 PM, Paul Kosinski <clamav-users@iment.com>
wrote:

> Are MP3 files ignored because it is impossible that MP3 software ever
> has buffer overflows or other security flaws???
>
> Or is it because MP3 files are compressed (i.e., random-looking) and
> thus may cause false positives? What about all the other compressed or
> encrypted file types which might do the same?
>
> In other words, I don't understand why they all would be ignored.
>
>
> On Mon, 17 Jul 2017 17:22:52 -0400
> Steven Morgan <smorgan@sourcefire.com> wrote:
>
> > Rosika,
> >
> > The reason the MP3 file is not scanned is because the file type
> > signatures for MP3 direct that they are ignored. Particularly:
> >
> >  "0:0:494433:MP3:CL_TYPE_ANY:CL_TYPE_IGNORED"
> >   and
> > "0:0:fffb90:MP3:CL_TYPE_ANY:CL_TYPE_IGNORED"
> >
> > These definitions are in the daily.ftm file of the ClamAV virus
> > database.
> >
> > Steve
> > ​
>
>
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
[prev in list] [next in list] [prev in thread] [next in thread]