X-Apparent-Data-Types not returning VBA type

Products

• Content Analysis Software - CA

Issue/Introduction

The CAS and ASG appliances don't return the file type VBA (Visual Basic for Applications)

For instance, when testing a Microsoft Office file known to contain a macro, under the CAS Management Console Utilities > Test, you may find a similar output as below:

ICAP/1.0 204 No modifications needed
X-Apparent-Data-Types: UNKN, JPG, ZIP, OLE, PPT
X-ICAP-Metadata: { \"expect_sandbox\": false }
Service: CAS 2.2.1.1(207429)
Service-ID: avscanner
ISTag: \"5A6640A8\"
Encapsulated: null-body=0
Date: Tue, 23 Jan 2018 00:25:18 GMT

The X-Apparent-Data-Types does not contain the VBA type.

Environment

CAS: versions 1.3.x and 2.x
ASG: all versions

Cause

The VBA is a programming language which was discontinued in 2008.
When the file contains macros, the CAS does not identify the file as VBA but as OLE (Object Linking and Embedding) which is a more accurate identification.

Resolution

A file, identified by the CAS as an OLE file, may contain macros which could potentially be harmful and should be treated accordingly.