lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: steve.wray at paradise.net.nz (Steve Wray)
Subject: BZIP2 bomb question

> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Gregh

> Please note I am not a good programmer here but here goes:

Hey, I'm not a programmer at all! (by choice; I like my wrists :)

> I am wondering why, for those who HAVE to auto unpack, a 
> script cannot be written which, upon receipt of an archive of any
sort, 
> inspects it for, as an example, 100K of the same character repeated
(keeping in 
> mind that the NULL character, chr$(7) etc have all been used for
compressed 
> bombs) and if there *IS* such a file, move the file to some safe
location 

You mean like...
unpack it to sdtout, passing this through a filter,
eg. involving head, grep, wc (maybe even perl)
and then send the final stdout to /dev/null?



Powered by blists - more mailing lists