0

ClamAV Scan found the virus Html.Exploit.CVE_2016_0108 on a .css file. What are the risks? How do I remove the code from the file? Thanks for any help.

closed as unclear what you're asking by Panther, mikewhatever, Terrance, Eric Carvalho, Braiam Mar 13 '16 at 14:41

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • in a CSS?! How is that suppose to infect your system? Can anyone explain the concept? – Rinzwind Mar 9 '16 at 17:58
  • 1
    CSS stylesheet files are used in web-browsers for formatting. Technically they are harmless, unless that file is masquerading itself with that .css extension. I would open the file in text editor and just read the source code for potential threats. Otherwise, really nothing to worry about – Sergiy Kolodyazhnyy Mar 9 '16 at 18:05
  • 2
    and since Linux does not really care about extensions .... Oh: and windows only-> web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0108 – Rinzwind Mar 9 '16 at 18:19
  • What CSS-file was that Fernando? I'm Autoptimize's developer and have 2 users reporting this problem with the aggregated/ optimized CSS and would like to investigate (and possibly submitt this as a false positive, if/ when confirmed). – futtta Mar 10 '16 at 9:07
2

clamav is notorious for false positives and there is no way to "remove the code from the file" - your only option is to manually review the file yourself or delete the file.

When you get a positive , you need to google search for information

http://bfy.tw/4fKd

Which gets to - https://clamxav.com/BB/viewtopic.php?p=17793

Up to you to trust that thread or do more research ...

If you need help , read the message / warning from clamav or post the exact message you re getting. You can pastebin the file and perhaps someone will review it.

See https://help.ubuntu.com/community/ClamAV

Clamav doesn't disinfect the files

See also How do I scan for viruses with ClamAV? and http://www.clamav.net/documents/miscellaneous-faq

Can ClamAV disinfect files?

No, it can’t.

1

I received the same alert regarding a few CSS files we had on our server starting yesterday morning. I was unable to get any help since this appears to be a new issue. I've come to the conclusion there is no fix except to white list this signature.

Doing some Googlin' I found that this has to do with an IE 11 vulnerability.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0108

http://www.scip.ch/en/?vuldb.81247

https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-0108

There doesn't seem to be a way to fix this. You can create a white list of virus signatures in the event of false positives. I don't think I'm going to run IE 11 on my Ubuntu server any time soon, so its safe to say you can ignore Html.Exploit.CVE_2016_0108

Following the instructions here I was able to successfully create an ignore list for ClamAV

http://sysnet-adventures.blogspot.com/2013/05/whitelist-files-with-clamav.html

create an ignore file using an editor of your choice, I'm using pico ( .ign2 indicates the new format http://pig.made-it.com/clamav.html )

pico /var/lib/clamav/whitelist-signatures.ign2 

And insert the signature

# /var/lib/clamav/whitelist-signatures.ign2
Html.Exploit.CVE_2016_0108

Then run a scan

sudo clamscan -r -i /path/to/dir/

You should see Infected files: 0

1

It seems most agree these are false positives, so best approach would be to submit them as such at http://www.clamav.net/reports/fp

I already did so for a couple of examples I was able to collect in Autoptimize's (CSS & JS optimizer for WordPress) thread on that topic.

frank

  • Oh nice! This is certainly a better approach, but in the mean time I'll be whitelisting. I don't need any more calls wondering why we're getting these Infection alerts via email! I also provided our sample CSS files that were triggering the false positives. Thanks for the link! – Eko3alpha Mar 10 '16 at 18:34
  • @Eko3alpha; just had a confirmation mail from Clam AV, pretty vague though. would be great if you could confirm tomorrow if your CSS-files are still being flagged? – futtta Mar 11 '16 at 19:21
  • 1
    I removed Html.Exploit.CVE_2016_0108 from the white list and ran the scan. I can confirm that the CSS files no longer trigger a false positive! – Eko3alpha Mar 11 '16 at 19:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.