procmail
[Top] [All Lists]

Re: Outlook Exploit Filter?

2000-07-20 17:29:41
From: "David W. Tamkin" <dattier(_at_)ripco(_dot_)com>

Goodness, Lee, as Dallman has said, that's a heck of a lot of outside
work for something procmail can do without help.

You want to drop any message with more than fifty characters in the
Date: header?  OK ...



 :0
 * ^\/Date:.*
 { DATEHEADER=$MATCH }

 :0
 * 1^1 DATEHEADER ?? .
 * -50^0
 /dev/null

Yup.  That's how I wanted to write it.  :-)  Scoring.

Might be as well to fix ALL headers to some reasonable size.

I don't know that you actually want to junk the mail; I can imagine some legit 
mail might have obnoxious headers. Perhaps wrapping the whole thing into 
another letter addressed to  the recipient and the original letter as the 
body? The missive then would be rendered safe, and capable of being handled in 
a more considered manner.



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail