Re: Overloading AV software, was Question about Viruses

[Valdis.Kletnieks () vt edu]

On Fri, 07 Jul 2006 16:55:15 EDT, Dude VanWinkle said:

> The zip-bomb?
>
> I seem to remember McAffe or Symantec doing that

No, the zip bombs were zips that unpacked into gigabytes of trash and
blew out the storage.  This was something structured like:

multipart/mixed
  multipart/mixed
    multipart/mixed
(.....)
         application/zip-worm

So it would look at the mime, unpack the multipart to scan the parts, then it
would have to unpack the inner multipart to scan its contents, then the *inner*
inner multipart, and so on...

Attachment: _bin
Description:

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.