bzip2 bombs still causes problems in antivirus-software

From: Dr. Peter Bieringer (pbieringer_at_aerasec.de)
Date: 01/09/04

  • Next message: Bassett, Mark: "Directory Traversal in Accipiter Direct Server 6.0" 
    Date: Fri, 09 Jan 2004 18:37:52 +0100
To: "full-disclosure@lists.netsys.com" <full-disclosure@lists.netsys.com>, "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>

    Hi,

    sure you remember the e-mail from Steve Wray in August 2003 about bzip2
    bombs and the possible DoS against antivirus-software:
    http://lists.netsys.com/pipermail/full-disclosure/2003-August/009255.html

    We found that this is still an issue, especially we found that one vendor
    detects bzip2 bombs by pattern (2 GB of zeros are detected, but not 2 GB of
    e.g. 0x31).

    Also others will neither detect the bomb, nor stopping decompression, looks
    like they missing smart code for anomaly detection and/or proper limits and
    eat all existing disk space and CPU power instead of reporting a problem.

    Namely we confirm this issue still exists on:

    * kavscanner of
       Kaspersky AntiVirus for Linux 5.0.1.0 (probably all versions since 4.5)
    * vscan of
       Trend Micro InterScan VirusWall 3.8 Build 1130
    * uvscan of
       McAfee Virus Scan for Linux v4.16.0

    Probably other versions and products are vulnerable, too.

    Full advisory is available here:

    http://www.aerasec.de/security/advisories/txt/bzip2bomb-antivirusengines.txt

    Hope this helps to bring this issue up again on software vendors to
    implement more smarter anomaly detection code and configurable limits
    (number of files, max size) in the decompression unit.

    Regards,
            Dr. Peter Bieringer 

    -- 
Dr. Peter Bieringer                             Phone: +49-8102-895190
AERAsec Network Services and Security GmbH        Fax: +49-8102-895199
Wagenberger Straße 1                           Mobile: +49-174-9015046
D-85662 Hohenbrunn                       E-Mail: pbieringer@aerasec.de
Germany                                Internet: http://www.aerasec.de
  • Next message: Bassett, Mark: "Directory Traversal in Accipiter Direct Server 6.0"

    Relevant Pages

    • bzip2 bombs still causes problems in antivirus-software
      ... sure you remember the e-mail from Steve Wray in August 2003 about bzip2 ... bombs and the possible DoS against antivirus-software: ... like they missing smart code for anomaly detection and/or proper limits and ... implement more smarter anomaly detection code and configurable limits ...
      (Full-Disclosure)
    • [Full-Disclosure] bzip2 bombs still causes problems in antivirus-software
      ... sure you remember the e-mail from Steve Wray in August 2003 about bzip2 ... bombs and the possible DoS against antivirus-software: ... like they missing smart code for anomaly detection and/or proper limits and ... implement more smarter anomaly detection code and configurable limits ...
      (Full-Disclosure)