Versions / Builds Affected20131111, 20140616
Problem SummaryA zip-bomb can cause marc.search.exe to crash
TT / JIRAID2222
How to IdentifyA zip-bomb is an email with a zip-attachment which is rather small in size - maybe a few MB. The zip-attachment contains extremely large files (normally txt-files) which are compress extremely efficient with a high compression ratio; e.g. a few GB.
When marc.search.exe tries to index the zip-attachment, it extracts the large files but eventually fails to index the large file.
There are not specific logs which indicate this specific situation.
The following high level steps should be taken to identify this issue:
1. The customer observes that marc.search.exe crashes (there should be generic crash Windows Application event logs)
2. When analyzing the debug logging, follow the Search logs to spot the last email which was indexed before the crash
3. The "next" email is potentially the zip-bomb
4. Download the "next" email from MARC and check if it is a zip-bomb
Workaround / Fix DetailsDisable attachment indexing as a whole or only for zip/rar files.
Fixed in MARC2015 build 20141117
Required ActionsUpgrade to the version mentioned in the fix section