Full Disclosure mailing list archives
Re: bzip2 bombs still causes problems in antivirus-software
From: "Dr. Peter Bieringer" <pbieringer () aerasec de>
Date: Sat, 10 Jan 2004 17:13:55 +0100
Steve Wray schreibt:
It would probably be a good idea to implement ulimit restrictions on the user that the software runs as.
Mostly "root"...and this will cause sure other fun, looks like some software didn't expect that file system runs out-of-space and still hang and have no fail-safe mechanism here...
Also you should be aware that the software doesn't automatically clear the leftovers out of the filesystem.
That's an additional suggestion for a smart decompression unit.
One suggestion I've heard is to put the directory where the zip files get unpacked for software forensics & antivirus detection be on tmpfs or some such. That way, after a reboot its guaranteed to not be there. Or something like that. (my favorite sentence)
Good idea...but the best will be vendors implementing the decompression unit in a proper way. BTW: note that the temp file created by Trend Micro's vscan has permission 644. This can be an interesting issue for other local users which are looking for data which they should normally prevent to see.
Regards, Peter -- Dr. Peter Bieringer Phone: +49-8102-895190 AERAsec Network Services and Security GmbH Fax: +49-8102-895199 Wagenberger Straße 1 Mobile: +49-174-9015046 D-85662 Hohenbrunn E-Mail: pbieringer () aerasec deGermany Internet: http://www.aerasec.de
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- bzip2 bombs still causes problems in antivirus-software Dr. Peter Bieringer (Jan 09)
- RE: bzip2 bombs still causes problems in antivirus-software Steve Wray (Jan 09)
- Re: bzip2 bombs still causes problems in antivirus-software Dr. Peter Bieringer (Jan 10)
- RE: Re: bzip2 bombs still causes problems in antivirus-software Steve Wray (Jan 10)
- RE: Re: bzip2 bombs still causes problems in antivirus-software Dr. Peter Bieringer (Jan 12)
- Re: bzip2 bombs still causes problems in antivirus-software Dr. Peter Bieringer (Jan 10)
- RE: bzip2 bombs still causes problems in antivirus-software Steve Wray (Jan 09)
- Re: bzip2 bombs still causes problems in antivirus-software...probably zip, too Dr. Peter Bieringer (Jan 12)