search

Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.39k stars 705 forks source link

pdf decoding issue #1109

Closed Sanesecurity closed 11 months ago

Sanesecurity commented 11 months ago

Describe the bug

received lots of pdf spam with a naked lady in it and inside the pdf is an embedded link to click on, which points to:

h t t p s: / /dating2 dot xloveme dot me/?cid=

engine doesn't seem to extract the above url or decode properly (even with --leave-temps), so can't really create a useful sig to block the link.

Attachments

Added attachment example pdf. xxx spam.pdf

micahsnyder commented 11 months ago

@Sanesecurity It looks like this is related to https://github.com/Cisco-Talos/clamav/pull/1079

I tested with 1.2.0 versus the latest in main (after this PR merged), and found that with 1.2.0, I see this in the debug log:

LibClamAV debug: check_user_password: UE length is not 32: 2
LibClamAV debug: check_user_password: user/owner password would be required for decryption
LibClamAV debug: pdf_find_and_extract_objs: encrypted pdf found, not decryptable, stream will probably fail to decompress!

But with the latest from main, the debug log has:

LibClamAV debug: aes_256cbc_decrypt: length is 32
LibClamAV debug: cli_pdf: check_user_password: Candidate encryption key: e1f38d2df5e217d2194971d54a971f0ea24bd55b30a4a2d1018729cb7b607374
LibClamAV debug: check_user_password: user password is empty

In addition, the --leave-temps from the latter resulted in a file containing 3 0 7 122 6 283 <</rect[0 0 580 800]/subtype/link/a<</s/uri/uri(https://dating2.xloveme.me/?cid=7smzqq&img=33&s6=7smzqq#ppins6kflgbh)>>>> <</type/page/mediabox[0 0 595 842]/resources<</procset [/pdf /text /imageb /imagec /imagei]/xobject<</img0 2 0 r>>>>/annots[3 0 r]/contents 5 0 r/parent 6 0 r>> <</type/pages/count 1/kids[7 0 r]/itxt(3.4.12.0)>>

micahsnyder commented 11 months ago

Going to close this as fixed, since it's working in main. The fix will be available in 1.3.0. The release candidate should be out next week-ish, and stable release out in early January.