Are zipped EXE files harmless for Linux servers?
I ran a malware scanner on my site, and it marked a bunch of zipped EXE files as potential risk files (these files got uploaded by users). Since I'm able to uncompress the files on my Mac I assume these are real ZIP files and not just something like renamed PHP files.
So the ZIP file shouldn't be any risk for my web server, right?
If they are indeed zipped Windows exe files, they should be harmless to your Linux system, unless you have something like Wine in place that could try to execute them.
But if they are in your web path, they could be malware and pose a big risk for your web sites' visitors (and you in turn, if you end up being marked as malware source and users get ugly warnings when they try to visit your site).
Since I'm able to uncompress the files on my mac I assume these are real zip files and not just something like renamed php files.
While you're probably right in this case, your assumption might not always hold. A ZIP archive remains valid even if you prepend arbitrary data to it, so it's quite possible to create a file that is simultaneously a valid ZIP archive containing innocent data and also a malicious PHP script. It's not even particularly hard; just concatenate the PHP code and the ZIP file, and make sure (e.g. using __halt_compiler()) that PHP won't try to parse the appended ZIP archive data.
This trick is legitimately used to create self-extracting ZIP files, but it's perfectly possible to prepend any other hidden data or executable code into a ZIP file in the same way. Some programs may refuse to open such modified ZIP files (but if so, they're technically violating the ZIP format spec), or they may identify the file as something other than a ZIP file by default, but generally, if you feed such a file into code that expects a ZIP file, it will probably be accepted as one.
A more common malicious use of such tricks is to disguise exploit code in a ZIP-based container (e.g. a JAR file) as something harmless (like a GIF image, as in the GIFAR exploit), but there's no reason it couldn't be used in the other direction too, e.g. to bypass a naïve file upload filter that forbids uploading PHP scripts but allows ZIP files, without checking if the uploaded file might be both at the same time.
There are at least two notable considerations you should take into account:
- If these files are distributed on your website, you might be held responsible if someone gets malware from your site. In the very least your site could be flagged for malware. If you decide to ignore malware scanner warnings, you should at least notify the uploader and possible downloaders that the file might be harmful (as EXEs downloaded from the Internet sometimes are).
- Do you do any processing on these files other than the malware scan? Automatic processing of attachments or other such uploads is always potentially dangerous, because the file contents could be anything. You don't even need to execute the EXE file if your utility software is vulnerable to some exploit and the seemingly nice zip/exe contains harmful content targeting your utility. I wouldn't let my server process anything that fails malware scanning.
So, depending on what your server does the file could potentially be harmful for your server or other users. Since I'm quite wary of EXEs downloaded from the Internet, I'd say that possible downloaders are the most potential users at risk here.
You can check if the files happen to be runnable on your Linux server by simply checking them with file FILENAME.exe command. Elf binaries (the executable format used on Linux) can be named with .exe extension to confuse an unsuspecting Linux admin, so it's probably a good idea to make that check before blindly trusting that these files are not runnable.