RE: Re: bzip2 bombs still causes problems in antivirus-software

["Dr. Peter Bieringer" <pbieringer () aerasec de>]

--On Sonntag, 11. Januar 2004 09:24 +1300 Steve Wray 
<steve.wray () paradise net nz> wrote:

> > Dr. Peter Bieringer
> >
> > Steve Wray schreibt:
> >
> > > It would probably be a good idea to implement ulimit
> > > restrictions on the user that the software runs as.
> >
> > Mostly "root"...and this will cause sure other fun, looks
> > like some software didn't expect that file system runs out-of-space
> and still
> > hang and have no fail-safe mechanism here...
>
> If your antivirus software (which, by definition, is routinely exposed
> to 'malware') runs as root, then you have worse potential issues than
> just a bzip bomb consuming resources.

You're right, but I'm not very sure that all global filesystem scanners on 
Linux/Unix (which need normally root permissions to get access on all files 
- on non-ACL and simple Unix group-usage systems) drop capabilities and/or 
chroot before decompressing/scanning a file to minimize the risk.

For in-line content scanners of mailsystems or FTP/HTTP running as non-root 
is hopefully a default.

It's not so nice that customers have to double-check how the products work 
internally...proper QA should be normally better placed on vendor's side ;-)

But btw: who of the customer cares about such issues in general? Seldom 
seen, that technical implementation of the antivirus software like e.g.

- daemons running root
- daemons/programs not dropping capabilities
- how many files have suid root and why
- insecure /tmp file handling
- insecure permissions on /tmp files and others
- insecure web interface (self made or outdated built-in HTTP server)
- admin password transfers in cleartext
- pattern update process needs root permissions
- ...many more...

was a real reason for a not-to-buy decission...

Because if would...vendors should have already react and provide more 
secure designed software...

        Peter
--
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Straße 1                           Mobile: +49-174-9015046
D-85662 Hohenbrunn                       E-Mail: pbieringer () aerasec de
Germany                                Internet: http://www.aerasec.de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html