This is already fixed in the latest CVS, though I'm not sure of the
production version:
[EMAIL PROTECTED] tmp]$ clamscan --block-max test.zip
zip.zip: Archive.ExceededRecursionLimit FOUND
----------- SCAN SUMMARY -----------
Known viruses: 60743
Engine version: devel-20060701
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Time: 1.843 sec (0 m 1 s)
[EMAIL PROTECTED] tmp]$
[EMAIL PROTECTED] wrote:
This zip file (see http://iki.fi/v/tmp/test.zip) created with the below
script (see http://iki.fi/v/tmp/test.create) is treated worse than it could
be by ClamAV.
It doesn't cause ClamAV to run out of memory (applause), but ClamAV would
probably use infinite time inspecting it and doesn't seem to find the virii
(Eicar test virus) buried in it.
It seems ClamAV uses breadth-first search to extract the recursive zip,
rather than depth-first.
F-Prot seems to do depth-first and immediately begins reporting virus
infections.
I suggest the following to treat this sort of malicious .zip's better:
- use depth-first search (will not help, of course, if the virus is _only_
in the last leaf of the zip tree)
- (optionally) bail out on first infection. This zip contains millions of
virii (depending on which parameters you choose in the script), no point
in finding them all
- limit recursion depth / cpu time somehow and decide the zip is malicious
if these limits are met. Searching through all of this zip would possibly
take millions of years. Imagine someone sending a few hundred of these to
a mail gateway using virus filtering.
Of, course this is not limited to .zip but all archive formats potentially
have the same problem.
---------------------------------------------------------------
# Create test.zip
f=foo
mkdir $f
for i in $(seq 1 10); do
# create 10 files full of zero
touch $f/$f-$i;
perl -e 'truncate "'$f/$f-$i'", 1024**2';
done
# add a test virus
wget http://www.eicar.org/download/eicar_com.zip -O foo/foo.zip
# recursively create a "tree" of zips
for j in $(seq 1 30); do
mkdir $j
zip -9 $j/$j-1.zip $f/$f*
for i in $(seq 2 20); do ln $j/$j-1.zip $j/$j-$i.zip; done
f=$j
done
zip -9 test.zip $f/$f*
---------------------------------------------------------------
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
