Problem solved, bug in sophie found
Markus Stumpf <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Organization | SpaceNet AG, Muenchen, Germany |
| Message-ID | <[email protected]> |
On Wed, Jan 21, 2004 at 10:19:36PM +0100, Maciej Uhlig wrote:
> do you happen to know the meaning of all possible option values for Sophos
> options?
0 = off
1 = on
for Grp* you can have values > 1. They represent "invalid".
This is not an error, but means "none of the configuration options in the
group will be altered", whatever that means.
All individual options only take 0 or 1 as valid settings. All
individual options are U32, but
MaxRecursionDepth U16
IdeDir STR
VirusDataDir STR
VirusDataName STR
Hmmm ... there is a SOPHOS_TYPE_OPTION_GROUP and the Grp* values
should probably be of that type.
Ok, I think I have found a bug in sophie.
sophie sets the Grp* options using a SOPHOS_TYPE_U32, but adding the
line
if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP;
make my problems go away.
Now sophie even recognizes the Troj/Sefex-A if "Mime: 0" is set.
The problem is in sophie_init.c
In function
sophie_set_engine_config()
look for
/* Crap... */
if (STRNCMP(option, "MaxRecursionDepth", 17))
stype = SOPHOS_TYPE_U16;
else
stype = SOPHOS_TYPE_U32;
and add the following line
if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP;
recompile, reinstall.
\Maex
--
SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
proportional to the amount of vacuity between the ears of the admin"