Archive nested too deeply

David Nalley davidn at KeyMarkinc.com
Fri Jul 21 16:21:12 IST 2006


> 
> My main query, I guess is that:
> 
> Jul 21 14:27:58 postbox MailScanner[21712]: Files hidden in 
> very deeply nested archive in E084A13FB1A.22FE1
> 
> doesn't really give me a hint as to whether I should be 
> changing the setting to 0/disabling it, or whether 5, 50 or 
> 500 will be better.
> 
I think the issue is that if you allow it to unzip continuously it could
lead to a situation where the virus scanner would time out and then pass
on a potentially harmful attachment. In addition it would burn CPU
cycles. 

Realistically, I think that you could open the zip files (assuming that
they are legitimate) and determine depth and use depth+n to make it a
non-issue. Unfortunately I don't really see a way of gunzip telling how
deeply nested the file is, other than it is nested at least once more
than the limit specified, and thus it has no way of giving you a hint. 


More information about the MailScanner mailing list