Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

inspired by Compress a 1GB file into 200_MB? and the related comments:

Many webservers today use a zipped HTTP Version (Gzip afaik).

How would Apache or any other server react to a zip bomb? Since the files are compressed, one could just send a prepared file and the target server would extract it to several GB/TB? Or is this in some way prevented? And when, how?

I hope I will not see the Internet crash due to this question ;-)

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You can be absolutely certain that there are people out there who spend a significant amount of time trying to crash Apache web servers externally, just as you can be sure that the Apache Software Foundation spends a significant amount of time testing their software to ensure that this type of attack will not succeed.

To specifically address your question; Apache uses mod_deflate to compress and decompress data sent and received. So, the target here is not Apache but the module used for handling compressed files.

Given that zip bombs are a well known vector of attack, and that it is possible to craft a request containing a maliciously formed zip object, this type of attack would fail.

You can be certain that the day someone finds a way to attack in this manner the problem will be identified and patched in a very short period of time.

Some applications have specific detection routines to detect and handle zip bombs.

share|improve this answer
    
Ok. I have guessed myself, that they have tested it (at least i would be very, very surprised if they missed it). I just don't KNOW what they have tested and what not. –  ChaosCakeCoder Feb 21 '13 at 8:07
    
That is a good question. Many open source projects use formal bug tracking or issue tracking software for this reason. Start here: issues.apache.org Bugzilla and Jira are common tool for this purpose. Have a search through their history. –  Underverse Feb 22 '13 at 1:11
    
Here is one of them: issues.apache.org/bugzilla/show_bug.cgi?id=50090 Bug 50090 - 'zip' bomb prevention –  Underverse Feb 22 '13 at 1:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.