Re: No SAVIsweepFile in libsavi.so.3.2.07.117
Gerard Earley <[email protected]> Fri, 04 Nov 2005 09:16:10 +0000
| Newsgroups | gmane.comp.security.virus.vtools |
|---|---|
| Organization | Whitecurve |
| Message-ID | <[email protected]> |
This is a cryptographically signed message in MIME format. --===============1223304559== Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms020902060005020405050108" This is a cryptographically signed message in MIME format. --------------ms020902060005020405050108 Content-Type: multipart/mixed; boundary="------------010901030708040701040604" This is a multi-part message in MIME format. --------------010901030708040701040604 Content-Type: multipart/alternative; boundary="------------000605070106050909030809" --------------000605070106050909030809 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit [email protected] wrote: >> If a new version of sophie might be coming, maybe you could include >> the patch to stop unwanted directory traversal (.. & .) in redhat >> > distros? > >> I can lay my hands on the patch if that will help. >> > > Do you mean modifying Sophie to explictly check for . and .. instead of > simply skipping the first two directories returned by readdir? If so, then > yes, that is one of the bugs being fixed in a future release of Sophie. If > thats not what you mean, can you send me the patch you are talking about? > > Regards, > Scott. > > _______________________________________________ > vtools mailing list > [email protected] > http://www.vanja.com/list/listinfo.cgi/vtools > That sounds like the same bug but I attach the patch I mentioned anyway, just in case its not. Its excellent to know that sophie is getting the attention of people at Sophos :-) --------------000605070106050909030809 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> wrote: <blockquote cite="midOFD8922D89.AED14305-ON492570AF.002F82E6-492570AF.002FEB23@sophos.com" type="cite"> <blockquote type="cite"> <pre wrap="">If a new version of sophie might be coming, maybe you could include the patch to stop unwanted directory traversal (.. & .) in redhat </pre> </blockquote> <pre wrap=""><!---->distros? </pre> <blockquote type="cite"> <pre wrap="">I can lay my hands on the patch if that will help. </pre> </blockquote> <pre wrap=""><!----> Do you mean modifying Sophie to explictly check for . and .. instead of simply skipping the first two directories returned by readdir? If so, then yes, that is one of the bugs being fixed in a future release of Sophie. If thats not what you mean, can you send me the patch you are talking about? Regards, Scott. _______________________________________________ vtools mailing list <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> <a class="moz-txt-link-freetext" href="http://www.vanja.com/list/listinfo.cgi/vtools">http://www.vanja.com/list/listinfo.cgi/vtools</a> </pre> </blockquote> That sounds like the same bug but I attach the patch I mentioned anyway, just in case its not.<br> <br> <br> Its excellent to know that sophie is getting the attention of people at Sophos :-)<br> </body> </html> --------------000605070106050909030809-- --------------010901030708040701040604 Content-Type: text/plain; name="sophie-redhat-traversal.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="sophie-redhat-traversal.patch" --- sophie_scandir.c.orginial 2005-02-11 15:06:19.545596743 +0800 +++ sophie_scandir.c 2005-02-11 15:09:03.513498364 +0800 @@ -34,11 +34,18 @@ } /* Let's get rid of '.' and '..' */ +/* direntry = readdir(dirpt); direntry = readdir(dirpt); +*/ while ((direntry = readdir(dirpt))) { + /* Let's get rid of '.' and '..' properly*/ + if((strcmp(direntry->d_name,".")==0)||(strcmp(direntry->d_name,"..")==0)) + { + continue; + } memset(path, 0, sizeof(path)); strncat(path, dirpath, sizeof(path)-1); strncat(path, "/", sizeof(path)-1); --------------010901030708040701040604-- --------------ms020902060005020405050108 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJhTCC Ax0wggKGoAMCAQICAw868DANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDUwODAxMTQyNzM3WhcNMDYwODAxMTQyNzM3 WjBgMQ8wDQYDVQQEEwZFYXJsZXkxDzANBgNVBCoTBkdlcmFyZDEWMBQGA1UEAxMNR2VyYXJk IEVhcmxleTEkMCIGCSqGSIb3DQEJARYVZ2VyYXJkQHdoaXRlY3VydmUuY29tMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0MQBHh47fP+kFDMv6LFRtYCwnbAAwDWuCTk3HXGe u7++nN8xERT+TOHJXQc0tpkTGtosoTfHImeforWSaAflenmIu08/HzsiwLhU4MRmaKPBuhON rZuKLa6AI1zu16Fce5sjFXATLczBwIHyVjmZ/CPBwQesw9HwP4bPuqZeP7QAXgM6VnBPbTMu Z6nEQJGleT64Qee/JVyji0tI5yL3up1UzHWDSiAWyNdKV//nFTCSDEBL7A3CFOtQodXowbqk qeu9EC1KlNxT9m27qvzPe8t3v0vqMZoqdJeF/Syoy8batKBQw6FQbCyhYndyIAA+w0wEGWIV Qw7pMfWTh1eB1QIDAQABo18wXTArBgUrZQEEAQQiMCACAQAwGzAZAgEEBBQzMkdhV1doTnRw MjNFRkRkcHdDWjAgBgNVHREEGTAXgRVnZXJhcmRAd2hpdGVjdXJ2ZS5jb20wDAYDVR0TAQH/ BAIwADANBgkqhkiG9w0BAQQFAAOBgQCAT6FE1xUmVDg+z1SpEV+l4NiO3JBRSr6aN9KLjMsz BboWBhdd/Jg5ya+X3sH0av5gp4zCBcYo6c5xFLxWIUJiUHeiR8nm8TlpXZu5ZMj/fHJvCTEJ vkJit00MyPGoLZ7P22La9O25z7Bez8/91fbFzg91IIbBNbQ0NHg8XO30OTCCAx0wggKGoAMC AQICAw868DANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3Rl IENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDUwODAxMTQyNzM3WhcNMDYwODAxMTQyNzM3WjBgMQ8wDQYD VQQEEwZFYXJsZXkxDzANBgNVBCoTBkdlcmFyZDEWMBQGA1UEAxMNR2VyYXJkIEVhcmxleTEk MCIGCSqGSIb3DQEJARYVZ2VyYXJkQHdoaXRlY3VydmUuY29tMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEA0MQBHh47fP+kFDMv6LFRtYCwnbAAwDWuCTk3HXGeu7++nN8xERT+ TOHJXQc0tpkTGtosoTfHImeforWSaAflenmIu08/HzsiwLhU4MRmaKPBuhONrZuKLa6AI1zu 16Fce5sjFXATLczBwIHyVjmZ/CPBwQesw9HwP4bPuqZeP7QAXgM6VnBPbTMuZ6nEQJGleT64 Qee/JVyji0tI5yL3up1UzHWDSiAWyNdKV//nFTCSDEBL7A3CFOtQodXowbqkqeu9EC1KlNxT 9m27qvzPe8t3v0vqMZoqdJeF/Syoy8batKBQw6FQbCyhYndyIAA+w0wEGWIVQw7pMfWTh1eB 1QIDAQABo18wXTArBgUrZQEEAQQiMCACAQAwGzAZAgEEBBQzMkdhV1doTnRwMjNFRkRkcHdD WjAgBgNVHREEGTAXgRVnZXJhcmRAd2hpdGVjdXJ2ZS5jb20wDAYDVR0TAQH/BAIwADANBgkq hkiG9w0BAQQFAAOBgQCAT6FE1xUmVDg+z1SpEV+l4NiO3JBRSr6aN9KLjMszBboWBhdd/Jg5 ya+X3sH0av5gp4zCBcYo6c5xFLxWIUJiUHeiR8nm8TlpXZu5ZMj/fHJvCTEJvkJit00MyPGo LZ7P22La9O25z7Bez8/91fbFzg91IIbBNbQ0NHg8XO30OTCCAz8wggKooAMCAQICAQ0wDQYJ KoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQ BgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsT H0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJz b25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh d3RlLmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpB MSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3 dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw gYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDX AmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16em u59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/ AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJz b25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UE AxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcP f6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQ lGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx0x1G /11fZU8xggM7MIIDNwIBATBpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwg SXNzdWluZyBDQQIDDzrwMAkGBSsOAwIaBQCgggGnMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0B BwEwHAYJKoZIhvcNAQkFMQ8XDTA1MTEwNDA5MTYxMFowIwYJKoZIhvcNAQkEMRYEFMj4vwIC e8xfw9OuoTv5xM0/6GyRMFIGCSqGSIb3DQEJDzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcN AwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMHgGCSsGAQQB gjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQ dHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB AgMPOvAwegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3 dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJl ZW1haWwgSXNzdWluZyBDQQIDDzrwMA0GCSqGSIb3DQEBAQUABIIBAH4oDJUe83WLDwZl2n8X l1XjfbQczC2ki3Lxlaj6sgwy3dQETzN5TB8NK8Z5vzgiz+Io77NA8D3c2JPfLsmWdQ+2hAih 1X0oQuuB0ldxtZREovaRwwwn+GIvvhtIoPqkDxiQEKyUYBZHZsZrigYyP90OQgGmM/RK5hc7 0u9srmDnsiqPKU+C02w/U8SY+cSgUF1C9hx2Gyu7Ic4BGEzCnPfsHsGWibzQUqmVG63VBrv+ Ja+Pmq9rgoP4im8aEemCWD7+aLrZn3qk/nhV/Q0zMyWcxB5Cub5qDmz/5BXE4izuiAhHyHkJ 1dD6DmPFXUzU5I3JwbNe+Vxq+cKvoG3EMjUAAAAAAAA= --------------ms020902060005020405050108-- --===============1223304559== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Disposition: inline Content-Transfer-Encoding: 7bit _______________________________________________ vtools mailing list [email protected] http://www.vanja.com/list/listinfo.cgi/vtools --===============1223304559==--