RE: [Clamav-users] Decompression Bombs

2004-02-04 Thread Tom Walsh
http://sourceforge.net/mailarchive/forum.php?thread_id=3839743&forum_id= 34617 Eric, thanks for that... I must have missed that email this morning since the topic didn't quite trigger anything in my brain... More along the lines of I thought it was a bug report... Ie: "bzip bombs" as in blows up

Re: [Clamav-users] Decompression Bombs

2004-02-04 Thread Erik Corry
On Wed, Feb 04, 2004 at 09:35:07AM -0600, Tom Walsh wrote: > I saw an article on bigtraq today that discussed an interesting vectored > attack against anti-virus software and was curious if any type of checks > were in place for clamav. http://sourceforge.net/mailarchive/forum.php?thread_id=383974

Re: [Clamav-users] Decompression Bombs

2004-02-04 Thread Tomasz Papszun
On Wed, 04 Feb 2004 at 9:35:07 -0600, Tom Walsh wrote: > I saw an article on bigtraq today that discussed an interesting vectored > attack against anti-virus software and was curious if any type of checks > were in place for clamav. > > Basically a decompression bomb is a zero padded file of extr

[Clamav-users] Decompression Bombs

2004-02-04 Thread Tom Walsh
I saw an article on bigtraq today that discussed an interesting vectored attack against anti-virus software and was curious if any type of checks were in place for clamav. Basically a decompression bomb is a zero padded file of extreme size (100GB) that is compressed using bzip, gzip, zip, etc...