On Feb 12, 2010, at 8:45 AM, "GrayHat" <[email protected]> wrote:
>> In 5+ years I had 2 false positives on my old server with this "look >> into a zip" method. Both times they were zipped zip files, and the >> developer patched them quickly. It's something worth looking into. > > a bit of warning; someone may decide to send you a critter like > > http://en.wikipedia.org/wiki/Zip_bomb > > and then you may be in BIG trouble :( Great point. It is my understandingthis is not an isue as the file is not uncompressed on the server, but read abd decoded in real time. Zip compression does not appear on the surface to be too complex, so looking for exe, bat, macro, etc type headers should be trivial without the CPU burden of actually decompressing the file. I'm only guessing this as it was a feature offered on OS 9 and I know that OS did not have the ability to do on the server decompression, plus you can look on the server and see there are mo temp files it is working on. -- Scott (Sent from a mobile device) ------------------------------------------------------------------------------ SOLARIS 10 is the OS for Data Centers - provides features such as DTrace, Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW http://p.sf.net/sfu/solaris-dev2dev _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
