procmail
[Top] [All Lists]

Re: Outlook Exploit Filter?

2000-07-21 08:27:38
You want to drop any message with more than fifty characters in the Date:
header?  OK ...

 :0
 * ^\/Date:.*
 { DATEHEADER=$MATCH }

 :0
 * 1^1 DATEHEADER ?? .
 * -50^0
 /dev/null


Is it possible for there to be more than one Date: header in a message
(even if it's not legal)?   If so, and the second one has the overflow,
the above recipe would miss it.  I don't know how likely this is,
or whether Outlook would be affected by the repeated header fields,
but it's just a thought....  Personally, i'm sticking with the non-
scoring, lotsa-dots recipe.  :)

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail