Project

General

Profile

Actions

Bug #2614

open

filemagic: pdf filemagic match

Added by Peter Manev about 4 years ago. Updated almost 2 years ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

(using the foo.cap attached and previously provided in this mail thread here - https://lists.openinfosecfoundation.org/pipermail/oisf-users/2018-August/016080.html )

1)
Using 4.1.0-dev (rev 1f4cd75f) with filestorev2 and having
fileextraction unconditionally enabled (
https://github.com/OISF/suricata/blob/master/suricata.yaml.in#L443
un-commented )

I get the 2 PDFs -

locallog/filestore/41/41bb5056d7760a903bb2b5462fe7480aeb3d34cf15d0299195795b6194bcbaf1:
PDF document, version 1.6
locallog/filestore/c6/c6f1db059595d3ff29e58129adf47f94c0d55d0aa3efa26cecb24d21c8c20ffa:
PDF document, version 1.4

root@DonPedro:/home/pevma/Work/Suricata/QA/tmp2# ls -lh
locallog/filestore/41/41bb5056d7760a903bb2b5462fe7480aeb3d34cf15d0299195795b6194bcbaf1
-rw-r--r-- 1 root root 294K Aug 24 16:54
locallog/filestore/41/41bb5056d7760a903bb2b5462fe7480aeb3d34cf15d0299195795b6194bcbaf1
root@DonPedro:/home/pevma/Work/Suricata/QA/tmp2# ls -lh
locallog/filestore/c6/c6f1db059595d3ff29e58129adf47f94c0d55d0aa3efa26cecb24d21c8c20ffa
-rw-r--r-- 1 root root 94K Aug 24 16:54
locallog/filestore/c6/c6f1db059595d3ff29e58129adf47f94c0d55d0aa3efa26cecb24d21c8c20ffa

2)

Disabled fileextraction unconditionally (
https://github.com/OISF/suricata/blob/master/suricata.yaml.in#L443
commented back )

and using only this rule -

alert http any any -> any any (msg:"FILE magic"; filemagic:"PDF
document"; filestore; sid:777; rev:1;)
i get no PDF files extracted. (although i should)

Using only this rule however -
alert http any any -> any any (msg:"FILE magic"; filemagic:"PDF";
filestore; sid:666; rev:1;)
I get the two PDFs extracted.

so it seems the only difference is filemagic:"PDF document" and
filemagic:"PDF". (it didnt use to be like that before - you could
just specify filemagic:"PDF document" and that was working as
expected)


Files

foo.zip (2.02 MB) foo.zip Peter Manev, 09/07/2018 01:08 PM
Actions #1

Updated by Andreas Herz over 3 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions #2

Updated by Victor Julien over 3 years ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Peter Manev

Can this be turned into a suricata-verify test?

Actions #3

Updated by Andreas Herz about 3 years ago

  • Assignee changed from Peter Manev to OISF Dev

Peter will you give it a try for suricata-verify?

Actions #4

Updated by Victor Julien about 3 years ago

  • Assignee changed from OISF Dev to Peter Manev
Actions #5

Updated by Victor Julien almost 2 years ago

  • Description updated (diff)
Actions

Also available in: Atom PDF