Project

General

Profile

Actions

Bug #437

open

filemagic / libmagic inconsistent between releases

Added by Victor Julien over 10 years ago. Updated about 3 years ago.

Status:
Feedback
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

See http://permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/15224

The issue is that the installed libmagic versions can return different results for the same file. This doesn't make libmagic/filemagic useless, but it does make it very hard to use for a ruleset like ET.

Possible solutions:
- ship/integrate libmagic so we always use the right version
- ship our own set of definitions for each libmagic version
- write our own file identify code (http://www.garykessler.net/library/file_sigs.html)


Related issues 1 (0 open1 closed)

Related to Feature #886: bromagic supportClosedActions
Actions #1

Updated by Victor Julien over 10 years ago

  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Target version set to TBD
Actions #2

Updated by Andreas Herz almost 7 years ago

Is this still an issue? Maybe we could gather a list of versions running on the distros to compare the file info.

Actions #3

Updated by Peter Manev almost 7 years ago

The challenge here is that this is OS/libmagic version dependent(that changes dynamically) - if we start generating and cross referencing lists we might find ourselves into administrative nightmare I fear.

I like Victor's first suggestion (above) in terms of consistency.
Thoughts?

Actions #4

Updated by Andreas Herz over 6 years ago

Some related informations also in #1268

Actions #5

Updated by Victor Julien over 5 years ago

  • Status changed from Assigned to New
  • Assignee changed from Victor Julien to OISF Dev
Actions #6

Updated by Andreas Herz over 5 years ago

Actions #7

Updated by Andreas Herz over 5 years ago

Would this solve #886 as well or did you have something else in mind with that ticket?

Actions #8

Updated by Victor Julien about 4 years ago

  • Assignee changed from OISF Dev to Anonymous
Actions #9

Updated by Andreas Herz over 3 years ago

  • Assignee set to Community Ticket
Actions #10

Updated by Andreas Herz about 3 years ago

  • Status changed from New to Feedback

Ping to team for feedback :)

Actions

Also available in: Atom PDF