[clamav-users] clamav blocking libreoffice macro

[Micah Snyder (micasnyd)]

Hi Hugo,

I don’t think ClamAV presently supports macro detection and macro blocking in libreoffice format documents, outside of the Microsoft office formats that libreoffice supports.
As a side note, for VBA and Excel 4.0 style macros, ClamAV is getting some improved macro detection in the soon-to-be-released 0.103 version.

Which office document formats exactly are you testing with?

Ged’s idea to write signatures to detect the macros is one possible solution though ideally ClamAV’s macro-blocking feature would work for all document formats.

Regards,
Micah

From: clamav-users <clamav-users-bounces at lists.clamav.net> On Behalf Of Hugo Boss via clamav-users
Sent: Tuesday, September 8, 2020 5:41 AM
To: clamav-users at lists.clamav.net
Cc: Hugo Boss <momphh at gmail.com>
Subject: [clamav-users] clamav blocking libreoffice macro

Hello,

I would to like to know how can I block with clamav libreoffice files with macro as MS Office files:

I turn :
OLE2BlockMacros yes
DetectPUA yes

But no result.

Kind of regards.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20200908/1f2214d8/attachment.htm>