Bug 101423 - Writer generates .doc with virus
Summary: Writer generates .doc with virus
Status: RESOLVED NOTOURBUG
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.1.4.2 release
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: security
: 101425 101426 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-08-10 08:37 UTC by Michael Tsang
Modified: 2016-08-10 10:45 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Attachments
virus-infected file (9.00 KB, application/msword)
2016-08-10 08:37 UTC, Michael Tsang 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Tsang 2016-08-10 08:37:32 UTC 
Created attachment 126717 [details]
virus-infected file

When I create an empty writer document, save it as .doc, the resulted file contains a virus, which, shown by clamscan, is Win.Exploit.CVE_2016_3316-1.
Comment 1 Aron Budea 2016-08-10 08:46:38 UTC 
*** Bug 101425 has been marked as a duplicate of this bug. ***
Comment 2 Aron Budea 2016-08-10 08:57:32 UTC 
Note:
The ClamAV update containing this signature was released yesterday.
Microsoft also released a patch yesterday: https://technet.microsoft.com/library/security/MS16-099
Comment 3 Aron Budea 2016-08-10 09:16:32 UTC 
*** Bug 101426 has been marked as a duplicate of this bug. ***
Comment 4 Aron Budea 2016-08-10 10:45:18 UTC 
https://www.virustotal.com/file/5abb791cef4455ae94299731cdaa8a3d0da2a166a09183efb83d7a2ec9fe0f0b/analysis/
Online analysis with 54 engines found no virus in file.

This is a false positive, see this thread:
http://lists.clamav.net/pipermail/clamav-users/2016-August/003236.html