"sophie -f 42.zip" vs "scan_file /var/run/sophie 42.zip"

"Juergen Georgi" <[email protected]>
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi,

I realized, that sophie (3.0.4rc2, Sophos 3.78, Solaris) cannot 
cope with compression bombs like 42.zip when invoked with 
"-f <42.zip>". It runs at high CPU load until "timeout" is 
reached , filling up /tmp with large files. The same applies 
to my MIMEdefang/sophie installation, where sophie does not 
finish cleanly on 42.zip, thus causing a temporary SMTP error. 

However, sophie has no problems when scanning the 42.zip file via
socket connection. When fed by sock.pl or scan_file, it correctly 
stops with "loop_decompr_limit reached".

My savi settings for ZIP handling are

| GrpArchiveUnpack                  |    9 |   2 |
| ZipDecompression                  |    3 |   1 |
| ZipUseChd                         |    3 |   1 |


What needs to be done such that MIMEdefang/sophie and "sophie -f"
no longer fail on 42.zip?

Regards,

-Juergen
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.