Re: Problem solved, bug in sophie found

Renato <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
I recompile Sophie with this new setting, but using
3.76 and 3.77b on Linux I still can't scan for
Troj/Sefex-A. I guess there are some bugs in libsavi
as well. 

--- Markus Stumpf
<[email protected]> wrote:
> On Wed, Jan 21, 2004 at 10:19:36PM +0100, Maciej
> Uhlig wrote:
> > do you happen to know the meaning of all possible
> option values for Sophos
> > options?
> 
> 0 = off
> 1 = on
> for Grp* you can have values > 1. They represent
> "invalid".
> This is not an error, but means "none of the
> configuration options in the
> group will be altered", whatever that means.
> 
> All individual options only take 0 or 1 as valid
> settings. All
> individual options are U32, but 
>     MaxRecursionDepth	U16
>     IdeDir		STR
>     VirusDataDir	STR
>     VirusDataName	STR
> 
> Hmmm ... there is a SOPHOS_TYPE_OPTION_GROUP and the
> Grp* values
> should probably be of that type.
> 
> Ok, I think I have found a bug in sophie.
> sophie sets the Grp* options using a
> SOPHOS_TYPE_U32, but adding the
> line
>     if (STRNCMP(option, "Grp", 3)) stype =
> SOPHOS_TYPE_OPTION_GROUP;
> make my problems go away.
> Now sophie even recognizes the Troj/Sefex-A if
> "Mime: 0" is set.
> 
> The problem is in  sophie_init.c
> In function
>     sophie_set_engine_config()
> look for
>     /* Crap... */
>     if (STRNCMP(option, "MaxRecursionDepth", 17))
> 	stype = SOPHOS_TYPE_U16;
>     else
> 	stype = SOPHOS_TYPE_U32;
> and add the following line
>     if (STRNCMP(option, "Grp", 3)) stype =
> SOPHOS_TYPE_OPTION_GROUP;
> 
> recompile, reinstall.
> 
> 	\Maex
> 
> -- 
> SpaceNet AG            | Joseph-Dollinger-Bogen 14 |
> Fon: +49 (89) 32356-0
> Research & Development |       D-80807 Muenchen    |
> Fax: +49 (89) 32356-299
> "The security, stability and reliability of a
> computer system is reciprocally
>  proportional to the amount of vacuity between the
> ears of the admin"
> _______________________________________________
> vtools mailing list
> [email protected]
> http://www.vanja.com/list/listinfo.cgi/vtools


__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free web site building tool. Try it!
http://webhosting.yahoo.com/ps/sb/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.