[clamav-users] scanning mp3-files with clamscan

[Steven Morgan]

Paul,

I don't know how an MP3 file would contain malware, other than possible
exploits of MP3 player/processor flaws.

If you want to have MP3 files scanned anyway, it is possible to change the
file type signatures for MP3 so they are not ignored. Also, I don't know of
any signatures for MP3.

Steve

On Mon, Jul 17, 2017 at 11:45 PM, Paul Kosinski <clamav-users at iment.com>
wrote:

> Are MP3 files ignored because it is impossible that MP3 software ever
> has buffer overflows or other security flaws???
>
> Or is it because MP3 files are compressed (i.e., random-looking) and
> thus may cause false positives? What about all the other compressed or
> encrypted file types which might do the same?
>
> In other words, I don't understand why they all would be ignored.
>
>
> On Mon, 17 Jul 2017 17:22:52 -0400
> Steven Morgan <smorgan at sourcefire.com> wrote:
>
> > Rosika,
> >
> > The reason the MP3 file is not scanned is because the file type
> > signatures for MP3 direct that they are ignored. Particularly:
> >
> >  "0:0:494433:MP3:CL_TYPE_ANY:CL_TYPE_IGNORED"
> >   and
> > "0:0:fffb90:MP3:CL_TYPE_ANY:CL_TYPE_IGNORED"
> >
> > These definitions are in the daily.ftm file of the ClamAV virus
> > database.
> >
> > Steve
> > ​
>
>