Re: Problem solved, bug in sophie found
"L. Jankok" <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Hi, The suggested patch will indeed make sophie detect the Sefex-A Trojan but at the same time will make sophie fail to detect most (if not all) of the old viruses out there. Regards, Lucio On 0, Markus Stumpf <[email protected]> wrote: :On Wed, Jan 21, 2004 at 10:19:36PM +0100, Maciej Uhlig wrote: :> do you happen to know the meaning of all possible option values for Sophos :> options? : :0 = off :1 = on :for Grp* you can have values > 1. They represent "invalid". :This is not an error, but means "none of the configuration options in the :group will be altered", whatever that means. : :All individual options only take 0 or 1 as valid settings. All :individual options are U32, but : MaxRecursionDepth U16 : IdeDir STR : VirusDataDir STR : VirusDataName STR : :Hmmm ... there is a SOPHOS_TYPE_OPTION_GROUP and the Grp* values :should probably be of that type. : :Ok, I think I have found a bug in sophie. :sophie sets the Grp* options using a SOPHOS_TYPE_U32, but adding the :line : if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP; :make my problems go away. :Now sophie even recognizes the Troj/Sefex-A if "Mime: 0" is set. : :The problem is in sophie_init.c :In function : sophie_set_engine_config() :look for : /* Crap... */ : if (STRNCMP(option, "MaxRecursionDepth", 17)) : stype = SOPHOS_TYPE_U16; : else : stype = SOPHOS_TYPE_U32; :and add the following line : if (STRNCMP(option, "Grp", 3)) stype = SOPHOS_TYPE_OPTION_GROUP; : :recompile, reinstall. : : \Maex : :-- :SpaceNet AG | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0 :Research & Development | D-80807 Muenchen | Fax: +49 (89) 32356-299 :"The security, stability and reliability of a computer system is reciprocally : proportional to the amount of vacuity between the ears of the admin" :_______________________________________________ :vtools mailing list :[email protected] :http://www.vanja.com/list/listinfo.cgi/vtools -- :wq!