"sophie -f 42.zip" vs "scan_file /var/run/sophie 42.zip"
"Juergen Georgi" <[email protected]>
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Message-ID | <[email protected]> |
Hi, I realized, that sophie (3.0.4rc2, Sophos 3.78, Solaris) cannot cope with compression bombs like 42.zip when invoked with "-f <42.zip>". It runs at high CPU load until "timeout" is reached , filling up /tmp with large files. The same applies to my MIMEdefang/sophie installation, where sophie does not finish cleanly on 42.zip, thus causing a temporary SMTP error. However, sophie has no problems when scanning the 42.zip file via socket connection. When fed by sock.pl or scan_file, it correctly stops with "loop_decompr_limit reached". My savi settings for ZIP handling are | GrpArchiveUnpack | 9 | 2 | | ZipDecompression | 3 | 1 | | ZipUseChd | 3 | 1 | What needs to be done such that MIMEdefang/sophie and "sophie -f" no longer fail on 42.zip? Regards, -Juergen