Hi, I use ClamAV on my mail exchangers (FreeBSD/Exim) and it appears that AES encrypted files are dropped because ClamAV doesn't recognize the compression method used.
On the WinZip website, the AES specification (http://www.winzip.com/aes_info.htm) indicates that the method compression code for AES crypted files is 99 (decimal). So it seems that the function zzip_file_open() in the file libclamav/zziplib/zzip-file.c need to be updated to support this new code. I've already patched my 0.85 (CVS suffers the same problem) and now AES zip files are treated correctly. Below the patch, if needed ;-) Regards, David Majorel --- zzip-file.c-orig Sat May 14 14:47:33 2005 +++ zzip-file.c Sat May 14 14:47:55 2005 @@ -192,10 +192,11 @@ case 0: /* store */ case 1: /* shrink */ case 6: /* implode */ case 8: /* inflate */ case 9: /* deflate */ + case 99: /* aes */ break; default: cli_dbgmsg("ZzipLib: Unsupported compression mode (%d)\n", hdr->d_compr); err = ZZIP_UNSUPP_COMPR; goto error; _______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
