bugtraq - Re: Decompression Bombs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m2r7x45dev.fsf@catbert.dok.org>
Date: Mon, 09 Feb 2004 13:13:44 -0500
From: Chris Green <cmg@....org>
To: myrond@...x.com
Cc: "David Bachtel" <dave@...ltimegaming.com>,
	"Matthias Leu" <mleu@...asec.de>, bugtraq@...urityfocus.com
Subject: Re: Decompression Bombs

"Myron Davis" <myrond@...x.com> writes:

> Theoretically one could modify a worm to send random zip'd files of zeros
> along the way to different hosts to really kill the destinations
> computers.
>

Is this all just back to fail open/fail closed?  I have a file that
will cause XXX virus scanner to crash.  Does the SMTP agent view that
as a reason to reject the email or does it pass it through?

If it does a temporary rejection message because of some internal
failure, the infection rateof these messages becomes very low. Not
sure how virus scanners + SMTP servers interact with regards to
tradition SMTP errors. 

It would be an effective anti-cleanup method though.
-- 
Chris Green <cmg@....org>
Fame may be fleeting but obscurity is forever.