Bug#726393: general: Possible malware infections in source packages

2013-10-19 Thread Henrique de Moraes Holschuh
On Fri, 18 Oct 2013, Thorsten Glaser wrote: On Tue, 15 Oct 2013, Thijs Kinkhorst wrote: I'm still not sure why the virus contained in the source could not be replaced by the EICAR test signature. Because it’s not testing a virus scanner, but because the specific RFC822 message in question

Bug#726393: general: Possible malware infections in source packages

2013-10-18 Thread Thorsten Glaser
Jarkko Palviainen jarkko.palviainen at f-secure.com writes: I looked into one of these, libmail-deliverystatus-bounceparser- perl_1.531.orig.tar.gz, and found multipart email file containing zip attachment. Inside this archive is a .pif file (PE32 executable for MS Windows) which is detected

Bug#726393: general: Possible malware infections in source packages

2013-10-18 Thread Thorsten Glaser
On Tue, 15 Oct 2013, Thijs Kinkhorst wrote: I'm still not sure why the virus contained in the source could not be replaced by the EICAR test signature. Because it’s not testing a virus scanner, but because the specific RFC822 message in question exhibited multiple problems in the code, due to

Bug#726393: general: Possible malware infections in source packages

2013-10-16 Thread Florian Weimer
* Dominik George: It isn't a false positive in that regard that the package *does* in fact contain the virus sample. That's non-free code and not suitable for main, so it must be removed from the source tarball anyway. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Jarkko Palviainen
Package: general Severity: normal Some of the source packages were caught on a gateway anti-virus scanner while downloading. These are the exact downloads: http://ftp.fi.debian.org/debian/pool/main/libm/libmime-explode-perl/libmime- explode-perl_0.39.orig.tar.gz

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Dominik George
Hi, I have looked into this a bit. Some of the source packages were caught on a gateway anti-virus scanner while downloading. Using a gateway anti-virus scanner for downloads from the Debian archive seems a bit inappropriate, well, paranoid. Checking the signed hashsums would seem a lot

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Scott Kitterman
Pymilter is a false positive. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Thijs Kinkhorst
On Tue, October 15, 2013 12:54, Dominik George wrote: I looked into one of these, libmail-deliverystatus-bounceparser- perl_1.531.orig.tar.gz, and found multipart email file containing zip attachment. Inside this archive is a .pif file (PE32 executable for MS Windows) which is detected as

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Dominique Dumont
On Tuesday 15 October 2013 13:19:38 Thijs Kinkhorst wrote: It isn't a false positive in that regard that the package *does* in fact contain the virus sample. However, it *is* a false positive, as the sample is there intentionally, and no virus scanner can guess the reason why it is there.

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Thijs Kinkhorst
On Tue, October 15, 2013 14:09, Dominique Dumont wrote: In libmail-deliverystatus-bounceparser-perl case, the virus is used on the non-regressions test which are shipped in the original tarball (and in Debian *source* package). This virus is *not* shipped in Debian binary package. I'm still

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Jarkko Palviainen
On 10/15/2013 03:09 PM, Dominique Dumont wrote: On Tuesday 15 October 2013 13:19:38 Thijs Kinkhorst wrote: It isn't a false positive in that regard that the package *does* in fact contain the virus sample. However, it *is* a false positive, as the sample is there intentionally, and no virus

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Adam D. Barratt
On 2013-10-15 11:54, Dominik George wrote: [Jarkko Palviainen; attribution lost in quoted mail] http://ftp.fi.debian.org/[...] If you suspect an issue with the Debian archive, please test against ftp.debian.org. That's not particularly great advice. ftp.debian.org is just another

Bug#726393: Info received (Bug#726393: general: Possible malware infections in source packages)

2013-10-15 Thread Scott Kitterman
Boots fine if the image is not persistent. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Bug#726393: Info received (Bug#726393: general: Possible malware infections in source packages)

2013-10-15 Thread Scott Kitterman
Scott Kitterman skl...@kitterman.com wrote: Boots fine if the image is not persistent. Sorry. Wrong bug. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org