full-disclosure - BZIP2 bomb question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200401122214.i0CMEpoq027474@post.webmailer.de>
From: list at nezwerg.de (Alexander Veit)
Subject: BZIP2 bomb question

Hi Greg,

> [...]
> I am wondering why, for those who HAVE to auto unpack, a 
> script cannot be written which, upon receipt of an
> archive of any sort, inspects it for, as an example,
> 100K of the same character repeated (keeping in mind
> that the NULL character, chr$(7) etc have all been used
> for compressed bombs) and if there *IS* such a file,
> move the file to some safe location for later manual
> inspection and if not, allow automatic unpacking etc.
> [...]

A safe detection of a such bombs by inspecting the stream of uncompressed
data seems impractical, since repeating patterns may consist of more than
one byte.

A better criterion may be the ratio of the size of currently uncompressed
data and the total archive size. This number should not exceed a reasonable
value.

-- 
Regards,
Alex