ClamAV: PUA.Win.Exploit.CVE_2012_0110 FOUND (/usr/share/mime/mime.cache)

Question

I recently scanned my system with (I am running the latest version of ClamAV and my definitions are up-to-date):

sudo clamscan -r --detect-pua --infected --bell /

And this one was of the results:

/usr/share/mime/mime.cache: PUA.Win.Exploit.CVE_2012_0110 FOUND

I have not seen anything like this before, so what is this, is this anything to worry about, and should I do anything about it? Also, what is the purpose of the location that it was found in?

Additional Information:

You can download the mime.cache file here: https://www.dropbox.com/s/58sxjv48ye4p6au/mime.cache?dl=0

And I appear to have found what this CVE_2012_0110 is, as it is one of the vulnerabilities listed on this page.

I have scanned the file on VirusTotal, and although the only thing which detected something bad was in the Additional information section at the bottom, I don't necessarily trust that all is well because if something was say injected into that file or something, then perhaps it would be more heuristics that would detect it rather than matching MD5 sums. Here is the report: report

---

OS Information:

Description:    Ubuntu 14.10
Release:    14.10

Answer 1

This is probably just a false positive. /usr/share/mime/mime.cache is a generated file of all known mime types on your system. It's not an executable.

Virus scanners detect malicious software by sets of known fingerprints (hashes). This model leads to some false positives, inevitably. Perhaps it's a coincedence a known Windows virus matches the fingerprint as found on a Linux system, perhaps it's because the fingerprint just matches a certain MIME type pattern that will match inevitably on any Linux system...

For now, I wouldn't worry about it, but just contact the ClamAV team to ask whether this is a known issue with them already.

Also make sure to stay updated with the most recent ClamAV fingerprints (freshclam).

Answer 2

I have a fresh installation of Ubuntu 15.10 and it appeared as soon as I started browsing the web. I only went to certain websites so far. I took a look inside the file and it does appear to be a collection of various programs on my computer. I changed permissions to /usr/share/mime/mime.cache to 400. I also emptied the file as root using:

 echo " " > /usr/share/mime/mime.cache

The command for changing permissions:

 chmod 400 /usr/share/mime/mime.cache

Also, ClamAV tends to detect viruses in the ~/.cache/mozilla/firefox/[string].default/cache2/entries/ directory, so I changed the permissions to 400 and nothing is downloaded in that directory anymore. [string] looks like about 10 alphanumeric characters that seem to be different for each user profile. Firefox still works, so this was an easy work-around. I have done the same on a Mac and Windows (different directory paths) for Firefox, Chrome, and Safari, and the browsers work and no entries are downloaded.

Answer 3

I had the same (cache PUA.Win.Exploit.CVE_2012_0110) on my Linux.

So I booted up from the USB or DISK instillation > To the try Linux mint out, > looked for the file in ( /usr/share/mime/mime.cache) and copped it to a USB stick. Logged back on to my installed Linux mint, and replaced the one on my sys, with the one I copped to my USB stick ( Now it no longer detected as a virus)