Re: Nessus DOS attack against Sophie

Hi Michael,

your sample file is the classic 42.zip bomb. however sophos does not 
handle this bomb very well. For this, there are better scanners outside.

I've talked to the sophos support and they promised to me to work on this, 
but nothing happend.

But you are not lost:

take a look at /etc/sophie.cfg and configure

timeout: 60
limit_decompr: 1000

this will not solve the problem, but reduces the time your system is
DOSed.  

See here a sample scan of your file (sophie_scan is 
sample_apps/sock/scan_file.c contributed with sophie):

# time sophie_scan /var/run/sophie /tmp/sophos-dos.zip
FILE ERROR [Notification loop_decompr_limit reached.] (-1 received)

real    0m9.945s
user    0m0.000s
sys     0m0.000s

so a Pentium4 2.4GHz needs about 10 secounds to reach the limit_decompr: 
1000

You also my tune the timeout to a more drastically value. 60 seconds is
realy long.... if you look at the timings, sophie takes minimal 0.004
seconds and I've never seen sophie scanning longer then a few hundredth
seconds on a heavy loaded machine.

Greetings,

Sascha.