On 8 Dec, George Chelidze wrote:
| [...]
|
| all badtransII viruses I have received came with the following format:
|
| [snipped otherwise those who ought to see this won't]
|
| Note that i wrote namme instead of name because my recipe will catch it
| as virus if i use name here:) [...]
A fix is pretty simple, though it might not be appropriate in all
circumstances. Add these conditions to prevent virus filtering on this
list and the various bugtraq lists.
* ! ^X-BeenThere: procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE\>
* ! ^List-Id:.*\.list-id\.securityfocus\.com\>
If the recipe has the B flag, as George's does, then insert "H ?? "
(without quotes) between ! and ^. Add other lists as needed.
This allows legitimate discussions in, at the risk of receiving a
payload from one of those lists. For me that's reasonable. I've yet to
receive one from either of those sources and know, even if I did, it
couldn't hurt anything. YMMV. Depending on who you're filtering for,
and what the risk paramaters are, that may still be an unacceptable
risk. But I would think it's a reasonable fix for at least some people.
--
Reply to list please, or append "6" to "procmail" in address if you must.
Spammers' unrelenting address harvesting forces me to this...reluctantly.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail