#1034635 libmagic1: Mis-detects pieces of xlsx as DOS executable (block device driver)

Package:
libmagic1
Source:
libmagic1
Description:
Recognize the type of data in a file using "magic" numbers - library
Submitter:
Samuel Thibault
Date:
2023-04-20 13:21:04 UTC
Severity:
normal
Tags:
#1034635#5
Date:
2023-04-20 13:19:01 UTC
From:
To:
Hello,

Some of the bills we are supposed to pay were not arriving in our
inbox... The logs we found was this:

Feb 23 15:41:34 hera amavis[894134]: (894134-17) Blocked BANNED (.exe,.exe-ms,[trash]/0000.dat) {DiscardedOpenRelay,Quarantined}, [216.71.136.224]:60522 [216.71.136.224] <prvs=411eebecd=adv-facturation@axione.fr> -> <tresorier@listes.aquilenet.fr>, quarantine: R/banned-RiI8tSiTJJDW, Queue-ID: 7776E4C7, Message-ID: <AS4P192MB181374DBB6AD52C5D839B164F2AB9@as4p192mb1813.eurp192.prod.outlook.com>, mail_id: RiI8tSiTJJDW, Hits: -, size: 512105, 1654 ms

and indeed the details of the bills, attached to the banned mail as
.xlsx (not attached here, as it contains private information), contains
in its zip format the following files, which I have attached:

[trash]/0000.dat
[trash]/0001.dat
[trash]/0002.dat
[trash]/0003.dat
[trash]/0004.dat

As you can see, they just contain \xff\xff\xff\xff\0\0\0[...], which
libmagic1 apparently interprets as DOS executables:

$ file *
0000.dat: DOS executable (block device driver)
0001.dat: DOS executable (block device driver)
0002.dat: DOS executable (block device driver)
0003.dat: DOS executable (block device driver)
0004.dat: DOS executable (block device driver)

This seems overzealous detection.

For our use, we have added this quick&dirty fix in /etc/magic:

0 lelong 0xffffffff

Samuel