Dr. Peter Bieringerand still
Steve Wray schreibt:
> It would probably be a good idea to implement ulimit > restrictions on the user that the software runs as.
Mostly "root"...and this will cause sure other fun, looks like some software didn't expect that file system runs out-of-spacehang and have no fail-safe mechanism here...
If your antivirus software (which, by definition, is routinely exposed to 'malware') runs as root, then you have worse potential issues than just a bzip bomb consuming resources.
You're right, but I'm not very sure that all global filesystem scanners on Linux/Unix (which need normally root permissions to get access on all files - on non-ACL and simple Unix group-usage systems) drop capabilities and/or chroot before decompressing/scanning a file to minimize the risk.
For in-line content scanners of mailsystems or FTP/HTTP running as non-root is hopefully a default.
It's not so nice that customers have to double-check how the products work internally...proper QA should be normally better placed on vendor's side ;-)
But btw: who of the customer cares about such issues in general? Seldom seen, that technical implementation of the antivirus software like e.g.
- daemons running root - daemons/programs not dropping capabilities - how many files have suid root and why - insecure /tmp file handling - insecure permissions on /tmp files and others - insecure web interface (self made or outdated built-in HTTP server) - admin password transfers in cleartext - pattern update process needs root permissions - ...many more...
was a real reason for a not-to-buy decission...
Because if would...vendors should have already react and provide more secure designed software...
Peter -- Dr. Peter Bieringer Phone: +49-8102-895190 AERAsec Network Services and Security GmbH Fax: +49-8102-895199 Wagenberger Stra�e 1 Mobile: +49-174-9015046 D-85662 Hohenbrunn E-Mail: [EMAIL PROTECTED] Germany Internet: http://www.aerasec.de
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
