Hi,

sure you remember the e-mail from Steve Wray in August 2003 about bzip2=20
bombs and the possible DoS against antivirus-software:
http://lists.netsys.com/pipermail/fu...st/009255.html

We found that this is still an issue, especially we found that one vendor=20
detects bzip2 bombs by pattern (2 GB of zeros are detected, but not 2 GB of =

e.g. 0x31).

Also others will neither detect the bomb, nor stopping decompression, looks =

like they missing smart code for anomaly detection and/or proper limits and =

eat all existing disk space and CPU power instead of reporting a problem.


Namely we confirm this issue still exists on:

* kavscanner of
Kaspersky AntiVirus for Linux 5.0.1.0 (probably all versions since 4.5)
* vscan of
Trend Micro InterScan VirusWall 3.8 Build 1130
* uvscan of
McAfee Virus Scan for Linux v4.16.0


Probably other versions and products are vulnerable, too.


Full advisory is available here:

http://www.aerasec.de/security/advis...usengines.txt=



Hope this helps to bring this issue up again on software vendors to=20
implement more smarter anomaly detection code and configurable limits=20
(number of files, max size) in the decompression unit.


Regards,
Dr. Peter Bieringer
--=20
Dr. Peter Bieringer Phone: +49-8102-895190
AERAsec Network Services and Security GmbH Fax: +49-8102-895199
Wagenberger Stra=DFe 1 Mobile: +49-174-9015046
D-85662 Hohenbrunn E-Mail: pbieringer@aerasec.de
Germany Internet: http://www.aerasec.de