bugtraq - Re: bzip2 bombs still causes problems in antivirus-software

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040110161356.25A05137E8@smtp2.aerasec.de>
Date: Sat, 10 Jan 2004 17:13:55 +0100
From: "Dr. Peter Bieringer" <pbieringer@...asec.de>
To: Steve Wray <steve.wray@...adise.net.nz>
Cc: full-disclosure@...ts.netsys.com, bugtraq@...urityfocus.com
Subject: Re: bzip2 bombs still causes problems in antivirus-software

Steve Wray schreibt: 

> It would probably be a good idea to implement ulimit
> restrictions on the user that the software runs as.

Mostly "root"...and this will cause sure other fun, looks like some software 
didn't expect that file system runs out-of-space and still hang and have no 
fail-safe mechanism here... 

> Also you should be aware that the software doesn't automatically
> clear the leftovers out of the filesystem.

That's an additional suggestion for a smart decompression unit. 

> One suggestion I've heard is to put the directory where the
> zip files get unpacked for software forensics & antivirus detection
> be on tmpfs or some such. That way, after a reboot its guaranteed
> to not be there. Or something like that. (my favorite sentence)

Good idea...but the best will be vendors implementing the decompression unit 
in a proper way. 

BTW: note that the temp file created by Trend Micro's vscan has permission 
644. This can be an interesting issue for other local users which are 
looking for data which they should normally prevent to see. 

Regards,
Peter
-- 
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Straße 1                           Mobile: +49-174-9015046
D-85662 Hohenbrunn                       E-Mail: pbieringer@...asec.de
Germany                                Internet: http://www.aerasec.de 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html