Oracle® Fusion Middleware
Part 15. Content Filters

The McAfee Anti-Virus filter scans incoming HTTP requests and their attachments for viruses and exploits. For example, if a virus is detected in a MIME attachment or in the XML message body, the API Gateway can reject the entire message and return a SOAP Fault to the client. In addition, this filter supports cleaning of messages from infections such as viruses and exploits. It also provides scan type presets for different detection levels, and reports overall message status after scanning.

McAfee virus scanner integration requires the McAfee 5600 Scan Engine. You must add the required third-party binaries to your API Gateway and Policy Studio installations.

To configure the McAfee Anti-Virus filter, perform the following steps:

When you configure a custom scan type, the following Custom options are available:

Decompress Archives:

This instructs the filter to scan each file in an archive for viruses. Types of archived files include the ZIP, JAR, TAR, ARJ, LHA, PKARC, PKZIP, RAR, WinACE, BZip, and Zcompress formats.

Decompress Executables:

Executables are sometimes compressed to decrease overall message size. In such cases, any embedded viruses are also compressed and may be missed by conventional scans. If this option is selected, the filter decompresses the executable before scanning it for viruses.

Fail Any Macros:

A macro is a series of commands that can be invoked in a single command or keystroke. While calling the macro can appear to be harmless, the initiated command sequence may be harmful. Macros are usually configured to run automatically when the host document is opened. When this option is selected, the API Gateway fails if any macro is detected in a compound document (whether it matches a virus signature or not). An appropriate SOAP Fault is returned to the client.

Heuristic Program Analysis:

A heuristic virus detection algorithm runs a series of probing tests on a file in an attempt to solicit virus-like behavior from it. Based on the results of these tests, the algorithm can then make an educated guess on whether the file represents a potential threat or not. For example, programs that attempt to modify or delete files, invoke email clients, or replicate themselves all display virus-like behavior and so may be treated as viruses by the scanner.

The major advantage of this type of analysis is that new viruses can be detected. With the signature detection method, the scanner attempts to find a fixed number of known virus signatures in a file. Because the number of known signatures is fixed, new or unknown viruses can not be detected. If this option is selected, the filter runs heuristic analysis on executables only.

Heuristic Macro Analysis:

When this option is enabled, the filter runs heuristic detection analysis on macros contained in any body parts of the message. If any viruses are detected, the message is blocked. If this option is selected, the API Gateway searches for virus signatures in the respective body parts of a MIME message. However, it can only search for known viruses using this method.

Scan Embedded Scripts:

The API Gateway can scan MIME parts, such as HTML documents, for embedded scripts. If this option is selected, the filter scans for embedded scripts.

Scan for Test Files:

When this option is selected, the API Gateway fails if it encounters an anti-virus test file (for example, eicar.com). This is a convenient way to check that the anti-virus filter successfully detects known viruses.

When the scan is complete, the McAfee Anti-Virus filter reports the overall message status in the mcafee.status message attribute, which is generated by the filter. This reflects the overall status of the scan for all message parts, and includes one of the following values:

When the McAfee Anti-Virus filter has been loaded, it searches for virus definitions in the following directory:

install-dir\conf\plugin\mcafee\datv2

When these have been loaded, it periodically checks for the presence of a directory named as follows:

install-dir\conf\plugin\mcafee\datv2.new

If the datv2.new directory is found, the scanner is stopped and the datv2 directory is renamed to datv2.0. If a datv2.0 directory already exists from a previous rollover, a datv2.1 directory is created instead, and so on, until an unused index is used. This means that the server never deletes the old files, and rolls them out of the way.

When the engine is stopped and restarted, any messages that require scanning are suspended until the restart completes. In addition, an initiated reload is suspended until all currently active scans are completed.

You can use the following commands to prevent this problem:

mkdir datv2.tmp
copy c:\mcafee\newfiles\*.* datv2.tmp 
rename datv2.tmp datv2.new

These create a temporary folder, copy the files into this folder, and rename the temporary folder to datv2.new. In this way, the scanner is guaranteed to pick up the virus definition files when it detects the new directory.

On Linux, the same approach applies, but the location of the file and the commands used are different. For example, enter the following commands from the install-dir/conf/plugin/mcafee directory:

mkdir datv2.tmp
cp /var/tmp/mcafee/newfiles/*.* datv2.tmp
mv datv2.tmp datv2.new