procmail
[Top] [All Lists]

Re: Outlook Exploit Filter?

2000-07-21 05:14:14
Hi,

I put some of the things that were said here together:

### begin rc ###
:0
* ^\/Date:.*
{ DATEHEADER=$MATCH }

:0
* 1^1 DATEHEADER ?? .
* -50^0
# All this is only executed, if the Date: field is longer than 50
# characters
{
# To have a (more or less precise but valid) Date: field, we take the
# date and time the mail arrived at our server:
:0
* ^Received:.*;[        ]*\/[a-z]+,[    ]+[^  ].*
# [] is space + tab
{ DATETIME = $MATCH }

:0 Af
|formail\
# Rename Date: field to Old-Date:, set new Date
 -i "Date: $DATETIME"\  
# In case X-Security already exists (Hi John) we take -i, not -A
 -i "X-Security: Detected Microsoft Outlook / Outlook Express GMT Field\
 Buffer Overflow Vulnerability. See\
 http://www.securityfocus.com/bid/1481 for details.\
 rcfile by jn(_at_)h6(_dot_)de"
}

Tested with Outlook 97 & 2000 on Windows NT4 SP5

Jan Niggemann

--
Neither I nor my employer will accept any liability for any problems
or consequential loss or damage caused by relying on this information.

JN1821-RIPE
pgp-key fingerprint: B6A8 ED32 EFEF 3F43 6F9B 510D 7A90 7FDC 462A 1ABC


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>