bugtraq - RE: Decompression Bombs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <591405C7D0FA584C81F1A3EB2AA36EFA923BA8@mailmx.hq.realtimegaming.com>
Date: Thu, 5 Feb 2004 14:24:00 -0500
From: "David Bachtel" <dave@...ltimegaming.com>
To: "Matthias Leu" <mleu@...asec.de>
Cc: <bugtraq@...urityfocus.com>
Subject: RE: Decompression Bombs

Wow, This is a very  interesting concept.  Any vendor that relies on any decompresion library could be vulnerable.  Anything from something like Photoshop to IE to virus scanners.

The example files given on the website seem to require a password.  Can you provide it?

Nice work and thanks!

Dave Bachtel
IT Intern
RealTime Gaming
Atlanta, GA - USA
404-459-4263 x139
♥♣♦♠

-----Original Message-----
From: Matthias Leu [mailto:mleu@...asec.de] 
Sent: Tuesday, February 03, 2004 12:04 PM
To: bugtraq@...urityfocus.com
Subject: Decompression Bombs

As a followup to http://www.securityfocus.com/bid/9393/, where we 
pointed out vulnerabilities of some antivirus-gateways while 
decompressing bzip2-bombs, we were interested in the behaviour of 
various applications that process compressed data.

It looks as if not only bzip2 bombs, but also decompression bombs in 
general might cause problems. Compression is used in many applications, 
but hardly any maximum size limits are checked during the decompression 
of untrusted content.

We've created several bombs (bzip2, gzip, zip, mime-embedded bombs, png 
and gif graphics, openoffice zip bombs). With these we tested some more 
applications like additional antivirus engines, various web browsers, 
openoffice.org, and the Gimp.

As a result, much more applications as we thought crashed. The 
manufacturers of software should care more about the processing of 
untrusted input.

For details see our full advisory, written by Dr. Peter Bieringer: 
http://www.aerasec.de/security/advisories/decompression-bomb-vulnerability.html

Best regards,
Dr. Matthias Leu
-- 
AERAsec Network Services and Security GmbH
Wagenberger Strasse 1
D-85662 Hohenbrunn, Germany
http://www.aerasec.de