2

On my Windows 8.1 computer I created an MS Word document containing a couple images I downloaded from the internet, and exported it as PDF. The MS Word version is 14.0.7232.5000, 64 bit. I sent that PDF to a number of recipients by email.

One email bounced with the line

MTP error from remote server for TEXT command, host: mailin.snafu.de (84.23.254.51) reason: 550 This message contains malware (Win.Exploit.CVE_2019_0903-6966169-0)

None of the other mails containing the same attachment bounced. When I scanned the attachment with virustotal.com just one of the 58 engines reported a detection, ClamAV. The detection was labeled exactly "Win.Exploit.CVE_2019_0903-6966169-0" (which may indicate that the provider uses ClamAV). On the details page one property of the file was marked as suspicious, "Contains at least one embedded file".

CVE-2019-0903 is a buffer overflow in the Windows GDI.

Question: Is this a false positive? If not, why do other engines not detect it, even though it has been public since May 15 and the CVE entry is from November 2018?

Peter - Reinstate Monica
  • 1,033
  • 8
  • 9
  • 1
    No time to write a full answer, but yes it appears to be a FP from ClamAV. See https://lists.clamav.net/pipermail/clamav-users/2019-May/008053.html and follow-up messages. – Tony Meyer May 27 '19 at 01:34

1 Answers1

5

It seems like a false-positive; from marc.info clamav:

Our system updated today:

May 25 09:24:20 daily.cld updated (version: 25460, sigs: 1581004, f-level: 
63, builder: raynman)

(Time is BST - i.e. UTC+1)

After that we saw a large number of viruses found - all detected as Win.Exploit.CVE_2019_0903-6966169-0

This seems to be including mails without any attachments.

Esa Jokinen
  • 16,100
  • 5
  • 50
  • 55
bizio
  • 51
  • 1
  • 1
    False-positive is very likely. Yesterday's ClamAV signatures gave me a false positive and caused some scans to fail with "Segmentation Fault 11". It reported `Win.Exploit.CVE_2019_0903-6966169-0 FOUND` in a PDF, and Virus Total reported the same from ClamAV, the only detection report. Both local scan issues are resolved in today's update daily-25462.cdiff, and Virus Total shows the file as clean. – Jonathan Dagle May 27 '19 at 13:32