procmail
[Top] [All Lists]

Re: badtrans again

2001-12-08 12:25:27
On  8 Dec, George Chelidze wrote:
| [...]
| 
| all badtransII viruses I have received came with the following format:
| 
| [snipped otherwise those who ought to see this won't]
| 
| Note that i wrote namme instead of name because my recipe will catch it 
| as virus if i use name here:) [...]

A fix is pretty simple, though it might not be appropriate in all
circumstances. Add these conditions to prevent virus filtering on this
list and the various bugtraq lists.

* ! ^X-BeenThere: procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE\>
* ! ^List-Id:.*\.list-id\.securityfocus\.com\>

If the recipe has the B flag, as George's does, then insert "H ?? "
(without quotes) between ! and ^. Add other lists as needed.

This allows legitimate discussions in, at the risk of receiving a
payload from one of those lists. For me that's reasonable. I've yet to
receive one from either of those sources and know, even if I did, it
couldn't hurt anything. YMMV. Depending on who you're filtering for,
and what the risk paramaters are, that may still be an unacceptable
risk. But I would think it's a reasonable fix for at least some people.

-- 
Reply to list please, or append "6" to "procmail" in address if you must.
Spammers' unrelenting address harvesting forces me to this...reluctantly.


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>