Wakko Warner wrote:
>>Although there was recently a bug found that if the header of a zip file
>>was altered to report the size of a file to be 0 bytes many scanners
>>would skip over the file assuming it to be safe. I wonder if the same
>>trick could be played to make the compression ratio look lower than it
>>actually is...
>
>
> Do you have any examples of a file like this?
>
Which one?
http://www.testvirus.org/ has a sample 0 byte forged .zip
file on test #27. But it doesn't make it past ClamAV 0.80, so I don't
actually have a sample.
As for the compression ratio theory, it was just something I was
wondering about, of which I haven't seen a proof of concept.
--
Chris
