ZIP bomb vulnerability!?

Hello All,

it seems that NOD32 tries to decompress every file in an archive bomb.

I can't believe this - anything I'm missing or is it true?

Oliver

 

NOD32 detects some archive bombs by a signature, it's impossible to detect them all somehow generically.

 

There are several possibilities to detect them, that's not rocket science.

You can set several limits after which the scanner aborts:

- execution time
- nesting depth (that's what F-Prot implemented after my niggling )
- total number of archives in the file

And report the file as suspicious.

I can recognize an archive bomb if I see it, and so should a virus scanner.

Oliver