possible fp pdf:cve-20133353[expl]

Viruses and worms
1

avast is detecting pdf:cve-20133353[expl] on two files on two computers . I download same the files on both computers in may and on virus total no programs other than avast is detecting it . https://www.virustotal.com/en/file/7a850df54b090f51c664212109916a7339ba64d84db7501edb422c3aba8996fc/analysis/1384557580/

https://www.virustotal.com/en/file/7a850df54b090f51c664212109916a7339ba64d84db7501edb422c3aba8996fc/analysis/1384557688/

2

New at VT
First submission 2013-11-15 23:01:59 UTC ( 25 minutes ago )

Vulnerability Summary for CVE-2013-3353
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3353

3

so do I have a virus ?

4

since it is so New, difficult to say…
you can send it to avast as possible FP case … if false detection it will be corrected

You can upload files and report cases to avast here: http://www.avast.com/contact-form.php (Select form subject according to Your case)

you can also use mail

send to virus@avast.com in a password protected zip file
mail subject: False Positive / undetected sample (select subject according to your case)
zip password: infected

or you can send files from avast chest
how to use the chest. http://www.avast.com/faq.php?article=AVKB21

5

ok I submitted it how long does avast take to correct if it is fp ?

6

I too am receiving this warning for pdf files since this morning program update. I have sent in one of the pdf files via the chest. Hope it makes it there. Tried via the website 2 times and after it had finished uploading I got a blank white screen. So I am unsure if it sent. :smiley:

7

Depends on the lab workload… sometimes as quick as next stream update… but usually next day VPS release

8

Avast has found the same “virus” in a PDF file from 2008 in a commercial program. I doubt seriously that a commercial software product would have included a virus back in 2008.

9

me too, avast is detecting threats in pdf files created by my family tree program. I’ve had them for months and only with latest update is avast saying there is a threat. pdf:cve-2013-3357[expl]. Should I send that in from the chest too?

10

I too am getting this threat detected on a bunch of PDF’s from my employer. Also, I’ve had these files and Avast for a very long time with no threat detection. What gives? Please get on this Avast. Thanks.

11

and you have ofcourse send samples to avast lab so that they can correct it…

12

Before I send the 8 files (6 pdf that I have had for a long time and 2 tmp files) that Avast tagged last night as having this virus, I have a question. When they are submitted to Avast after being moved to the chest, will they be deleted from the chest?

I submitted a file some time ago that was an exe from a program on my computer. This action deleted it from the chest so I could no longer restore it. Instead, will have to reinstall if I ever want to use that program again.

I need some of the pdfs that have been tagged as viruses, and have a pretty strong feeling that these are false positives, so don’t want to get rid of the files.

Thanks for your help!

13

Hello,
detection was fixed in VPS 131116-0.

Milos

14

It is a virus. :frowning:
the case is that those nasty files are webserver virus. Yes, they can hickjack a Linux server (where is your god now?) but are inocuous in a non web accesible installation.
Currently, AVAST detect it as a virus if and only if download it via ftp, as far as I know.

15

it turns that is not a virus… kind of
is an exploit, so anyone can create a PDF that can be used to acces your server… unwilling to do so.
maybe compressing the files would solve this issue.

16

This likely “false positive” is back. Did a boot scan last night and got 4 files, all in the Windows\Installer directory reporting as being infected with PDF CVE 2013-3353. Boot scan quarantined one (1d17ded5.msi) and deleted the others. No harms seems to have been done.

I tried to send the one in the quarantine chest to Avast Virus lab, but the when I right click on it in the chest, and choose submit to Virus Lab, the next screen to enter the details does not pop up. I tested this function on other items in the quarantine chest and the second window pops up just fine. Just not with this one item. So I extracted it and will email to AVAST.

UPDATE: Not able to email to Avast either. Filled out the form on Avast contact page to send to Virus Lab but after clicking to send, nothing happens and next page cannot be loaded.