5

I recently scanned my system with (I am running the latest version of ClamAV and my definitions are up-to-date):

sudo clamscan -r --detect-pua --infected --bell /

And this one was of the results:

/usr/share/mime/mime.cache: PUA.Win.Exploit.CVE_2012_0110 FOUND

I have not seen anything like this before, so what is this, is this anything to worry about, and should I do anything about it? Also, what is the purpose of the location that it was found in?

Additional Information:

You can download the mime.cache file here: https://www.dropbox.com/s/58sxjv48ye4p6au/mime.cache?dl=0

And I appear to have found what this CVE_2012_0110 is, as it is one of the vulnerabilities listed on this page.

I have scanned the file on VirusTotal, and although the only thing which detected something bad was in the Additional information section at the bottom, I don't necessarily trust that all is well because if something was say injected into that file or something, then perhaps it would be more heuristics that would detect it rather than matching MD5 sums. Here is the report: report


OS Information:

Description:    Ubuntu 14.10
Release:    14.10
  • Can you try scanning the file again after running sudo update-mime-database /usr/share/mime/ and also upload it to virustotal.com? Related document: standards.freedesktop.org/shared-mime-info-spec/… – LiveWireBT Apr 19 '15 at 16:02
  • @LiveWireBT: Ok, I have done both of those things (in order), and have edited my question to include more information. – user364819 Apr 19 '15 at 16:19
  • according to virus databases from different AV labs it refers to: This is a detection for malicious html files which exploit the CVE-use-after-free vulnerability found in Microsoft Internet Explorer, that could allow an attackers to download and run a malicious executable file on the system. Microsoft Internet Explorer 10 is affected. And other CVE infections stated on also: found in the Microsoft Windows NDProxy driver, that could allow attackers to run code in Kernel mode. The vulnerable systems are the running Windows XP or Windows Server 2003 – JoKeR Apr 19 '15 at 16:48
  • @JoKeR: What about the matching CVE-ID I found on the Oracle site? – user364819 Apr 19 '15 at 16:58
  • Yes, I saw that it's true but all the reports were from Windows Server machines, so I can't say anything else here. – JoKeR Apr 19 '15 at 17:04
5

This is probably just a false positive. /usr/share/mime/mime.cache is a generated file of all known mime types on your system. It's not an executable.

Virus scanners detect malicious software by sets of known fingerprints (hashes). This model leads to some false positives, inevitably. Perhaps it's a coincedence a known Windows virus matches the fingerprint as found on a Linux system, perhaps it's because the fingerprint just matches a certain MIME type pattern that will match inevitably on any Linux system...

For now, I wouldn't worry about it, but just contact the ClamAV team to ask whether this is a known issue with them already.

Also make sure to stay updated with the most recent ClamAV fingerprints (freshclam).

2

I had the same (cache PUA.Win.Exploit.CVE_2012_0110) on my Linux.

So I booted up from the USB or DISK instillation > To the try Linux mint out, > looked for the file in ( /usr/share/mime/mime.cache) and copped it to a USB stick. Logged back on to my installed Linux mint, and replaced the one on my sys, with the one I copped to my USB stick ( Now it no longer detected as a virus)

0

I have a fresh installation of Ubuntu 15.10 and it appeared as soon as I started browsing the web. I only went to certain websites so far. I took a look inside the file and it does appear to be a collection of various programs on my computer. I changed permissions to /usr/share/mime/mime.cache to 400. I also emptied the file as root using:

 echo " " > /usr/share/mime/mime.cache

The command for changing permissions:

 chmod 400 /usr/share/mime/mime.cache

Also, ClamAV tends to detect viruses in the ~/.cache/mozilla/firefox/[string].default/cache2/entries/ directory, so I changed the permissions to 400 and nothing is downloaded in that directory anymore. [string] looks like about 10 alphanumeric characters that seem to be different for each user profile. Firefox still works, so this was an easy work-around. I have done the same on a Mac and Windows (different directory paths) for Firefox, Chrome, and Safari, and the browsers work and no entries are downloaded.

  • this locked me out of my system with a login loop. I wouldnt do this unless you know how to fix it! – Kalamalka Kid May 12 '16 at 11:06
  • if you get locked out using this method please see: ubuntuforums.org/showthread.php?t=2295431 – Kalamalka Kid May 12 '16 at 11:17
  • Where did you get a log in loop error? I have done this on Mac, Ubuntu, CentOS, and OpenSUSE. I even go so far as chmod -R 000 ~/.cache/mozilla/firefox/[string].default/cache2/entries/ and I never have had issues with firefox. Try running firefox from your terminal emulator $ firefox, which will print any errors while browsing. Likely, you have other errors that upon research and troubleshooting, can be fixed at `about:config' in firefox. – technerdius Jun 17 '16 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy