Denial of service through decompression bombs

[Oleg Vaskevich]

Decompression bombs, which result from a small file being uncompressed into a bigger one, can freeze the current application such as a browser, virus scanner, search tool and create system instability. More information about this can be found here:

http://www.aerasec.de/security/advisories/decompression-bomb-vulnerability.html

Sorry if this is already known of/unpreventable, but it can really harm and freeze a computer, depending on the size of the compressed file. Examples are available off the previous link.

Expected Behavior: An alert shown to the user, earlier termination of the application opening such file, or end in processing of that file.
Actual behavior: Application freezes (ui) and eventually the whole system starts lagging. Perhaps applications should have a "maximum cpu usage allowed" or something like that?

[Oleg Vaskevich (olegv)]

The images can freeze the browser while the text files can freeze the text editor. Password to open those archives is AERAsec (specified in the read me file.) Again, this may be worthless and uncommon, but something that can unintentially freeze a browser and possibly the system can be dangerous.

[Michael Nagel (nailor)]

thanks for reporting, but right here in the launchpad bug tracker we track precise bugs, that is where expected behavior does not match expected behavior and it's clear what should be done. this issue can not (yet, because it should be discussed WHAT EXACTLY should be done) be adressed thus...

[Oleg Vaskevich (olegv)]

Ok, updated description.

[Sebastien Bacher (seb128)]

The ubuntu team doesn't have the ressources to work on this specific issue but it would be nice if somebody could send the bug the to the people writting the software (https://wiki.ubuntu.com/Bugs/Upstream/GNOME)

[Pedro Villavicencio (pedro)]

Thanks for your bug report. This bug has been reported to the developers of the software. You can track it and make comments here: http://bugzilla.gnome.org/show_bug.cgi?id=590148