Bug#726393: general: Possible malware infections in source packages

2013-10-19 Thread Henrique de Moraes Holschuh
On Fri, 18 Oct 2013, Thorsten Glaser wrote: > On Tue, 15 Oct 2013, Thijs Kinkhorst wrote: > > I'm still not sure why the virus contained in the source could not be > > replaced by the EICAR test signature. > > Because it’s not testing a virus scanner, but because the > specific RFC822 message in q

Bug#726393: general: Possible malware infections in source packages

2013-10-18 Thread Thorsten Glaser
Jarkko Palviainen f-secure.com> writes: > I looked into one of these, libmail-deliverystatus-bounceparser- > perl_1.531.orig.tar.gz, and found multipart email file containing zip > attachment. Inside this archive is a .pif file (PE32 executable for MS Windows) > which is detected as Win32.Worm.My

Bug#726393: general: Possible malware infections in source packages

2013-10-18 Thread Thorsten Glaser
On Tue, 15 Oct 2013, Thijs Kinkhorst wrote: > I'm still not sure why the virus contained in the source could not be > replaced by the EICAR test signature. Because it’s not testing a virus scanner, but because the specific RFC822 message in question exhibited multiple problems in the code, due to

Bug#726393: general: Possible malware infections in source packages

2013-10-16 Thread Florian Weimer
* Dominik George: > It isn't a false positive in that regard that the package *does* in fact > contain the virus sample. That's non-free code and not suitable for main, so it must be removed from the source tarball anyway. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org w

Bug#726393: Info received (Bug#726393: general: Possible malware infections in source packages)

2013-10-15 Thread Scott Kitterman
Scott Kitterman wrote: >Boots fine if the image is not persistent. Sorry. Wrong bug. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#726393: Info received (Bug#726393: general: Possible malware infections in source packages)

2013-10-15 Thread Scott Kitterman
Boots fine if the image is not persistent. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Adam D. Barratt
On 2013-10-15 11:54, Dominik George wrote: [Jarkko Palviainen; attribution lost in quoted mail] http://ftp.fi.debian.org/[...] If you suspect an issue with the Debian archive, please test against ftp.debian.org. That's not particularly great advice. ftp.debian.org is just another mirror[tm];

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Jarkko Palviainen
On 10/15/2013 03:09 PM, Dominique Dumont wrote: On Tuesday 15 October 2013 13:19:38 Thijs Kinkhorst wrote: It isn't a false positive in that regard that the package *does* in fact contain the virus sample. However, it *is* a false positive, as the sample is there intentionally, and no virus scan

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Thijs Kinkhorst
On Tue, October 15, 2013 14:09, Dominique Dumont wrote: > In libmail-deliverystatus-bounceparser-perl case, the virus is used on the > non-regressions test which are shipped in the original tarball (and in > Debian *source* package). This virus is *not* shipped in Debian binary > package. I'm stil

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Dominique Dumont
On Tuesday 15 October 2013 13:19:38 Thijs Kinkhorst wrote: > > It isn't a false positive in that regard that the package *does* in fact > > contain the virus sample. However, it *is* a false positive, as the > > sample is there intentionally, and no virus scanner can guess the reason > > why it is

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Thijs Kinkhorst
On Tue, October 15, 2013 12:54, Dominik George wrote: >> I looked into one of these, libmail-deliverystatus-bounceparser- >> perl_1.531.orig.tar.gz, and found multipart email file containing zip >> attachment. Inside this archive is a .pif file (PE32 executable for MS >> Windows) >> which is detect

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Scott Kitterman
Pymilter is a false positive. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Dominik George
Hi, I have looked into this a bit. > Some of the source packages were caught on a gateway anti-virus scanner while > downloading. Using a gateway anti-virus scanner for downloads from the Debian archive seems a bit inappropriate, well, paranoid. Checking the signed hashsums would seem a lot bett

Bug#726393: general: Possible malware infections in source packages

2013-10-15 Thread Jarkko Palviainen
Package: general Severity: normal Some of the source packages were caught on a gateway anti-virus scanner while downloading. These are the exact downloads: http://ftp.fi.debian.org/debian/pool/main/libm/libmime-explode-perl/libmime- explode-perl_0.39.orig.tar.gz http://ftp.fi.debian.org/debian/p