Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

inspired by Compress a 1GB file into 200_MB? and the related comments:

Many webservers today use a zipped HTTP Version (Gzip afaik).

How would Apache or any other server react to a zip bomb? Since the files are compressed, one could just send a prepared file and the target server would extract it to several GB/TB? Or is this in some way prevented? And when, how?

I hope I will not see the Internet crash due to this question ;-)

share|improve this question
up vote 1 down vote accepted

You can be absolutely certain that there are people out there who spend a significant amount of time trying to crash Apache web servers externally, just as you can be sure that the Apache Software Foundation spends a significant amount of time testing their software to ensure that this type of attack will not succeed.

To specifically address your question; Apache uses mod_deflate to compress and decompress data sent and received. So, the target here is not Apache but the module used for handling compressed files.

Given that zip bombs are a well known vector of attack, and that it is possible to craft a request containing a maliciously formed zip object, this type of attack would fail.

You can be certain that the day someone finds a way to attack in this manner the problem will be identified and patched in a very short period of time.

Some applications have specific detection routines to detect and handle zip bombs.

share|improve this answer
    
Ok. I have guessed myself, that they have tested it (at least i would be very, very surprised if they missed it). I just don't KNOW what they have tested and what not. – ChaosCakeCoder Feb 21 '13 at 8:07
    
That is a good question. Many open source projects use formal bug tracking or issue tracking software for this reason. Start here: issues.apache.org Bugzilla and Jira are common tool for this purpose. Have a search through their history. – Underverse Feb 22 '13 at 1:11
    
Here is one of them: issues.apache.org/bugzilla/show_bug.cgi?id=50090 Bug 50090 - 'zip' bomb prevention – Underverse Feb 22 '13 at 1:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .