Problem solved, bug in sophie found

Markus Stumpf <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Organization SpaceNet AG, Muenchen, Germany
Message-ID <[email protected]>
On Wed, Jan 21, 2004 at 10:19:36PM +0100, Maciej Uhlig wrote:
> do you happen to know the meaning of all possible option values for Sophos
> options?

0 = off
1 = on
for Grp* you can have values > 1. They represent "invalid".
This is not an error, but means "none of the configuration options in the
group will be altered", whatever that means.

All individual options only take 0 or 1 as valid settings. All
individual options are U32, but 
    MaxRecursionDepth	U16
    IdeDir		STR
    VirusDataDir	STR
    VirusDataName	STR

Hmmm ... there is a SOPHOS_TYPE_OPTION_GROUP and the Grp* values
should probably be of that type.

Ok, I think I have found a bug in sophie.
sophie sets the Grp* options using a SOPHOS_TYPE_U32, but adding the
line
    if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP;
make my problems go away.
Now sophie even recognizes the Troj/Sefex-A if "Mime: 0" is set.

The problem is in  sophie_init.c
In function
    sophie_set_engine_config()
look for
    /* Crap... */
    if (STRNCMP(option, "MaxRecursionDepth", 17))
	stype = SOPHOS_TYPE_U16;
    else
	stype = SOPHOS_TYPE_U32;
and add the following line
    if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP;

recompile, reinstall.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.