full-disclosure - Re: bzip2 bombs still causes problems in antivirus-software

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4776107.1073906524@[10.3.62.6]>
From: pbieringer at aerasec.de (Dr. Peter Bieringer)
Subject: Re: bzip2 bombs still causes problems in
 antivirus-software

--On Sonntag, 11. Januar 2004 09:24 +1300 Steve Wray 
<steve.wray@...adise.net.nz> wrote:

>> Dr. Peter Bieringer
>>
>> Steve Wray schreibt:
>>
>> > It would probably be a good idea to implement ulimit
>> > restrictions on the user that the software runs as.
>>
>> Mostly "root"...and this will cause sure other fun, looks
>> like some software didn't expect that file system runs out-of-space
> and still
>> hang and have no fail-safe mechanism here...
>
> If your antivirus software (which, by definition, is routinely exposed
> to 'malware') runs as root, then you have worse potential issues than
> just a bzip bomb consuming resources.

You're right, but I'm not very sure that all global filesystem scanners on 
Linux/Unix (which need normally root permissions to get access on all files 
- on non-ACL and simple Unix group-usage systems) drop capabilities and/or 
chroot before decompressing/scanning a file to minimize the risk.

For in-line content scanners of mailsystems or FTP/HTTP running as non-root 
is hopefully a default.

It's not so nice that customers have to double-check how the products work 
internally...proper QA should be normally better placed on vendor's side ;-)

But btw: who of the customer cares about such issues in general? Seldom 
seen, that technical implementation of the antivirus software like e.g.

- daemons running root
- daemons/programs not dropping capabilities
- how many files have suid root and why
- insecure /tmp file handling
- insecure permissions on /tmp files and others
- insecure web interface (self made or outdated built-in HTTP server)
- admin password transfers in cleartext
- pattern update process needs root permissions
- ...many more...

was a real reason for a not-to-buy decission...

Because if would...vendors should have already react and provide more 
secure designed software...

	Peter
-- 
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Stra?e 1                           Mobile: +49-174-9015046
D-85662 Hohenbrunn                       E-Mail: pbieringer@...asec.de
Germany                                Internet: http://www.aerasec.de