procmail
[Top] [All Lists]

Re: procmail and virus

2001-12-17 04:12:46
FYI, there are some reports that IE will extract virii even if the
MIME-Version:/Content-Types: headers are removed-IE looks into the
body. (This was reported to MS, but I don't know the disposition.)

Additionally, virii that are forwarded from user's address books in
Novell's Groupware have a different MIME header construct than MS,
although it is MIME compliant.

        John

Udi Mottelo writes:

On Thu, 13 Dec 2001, Tim Luoma wrote:

[...]
Basically I use metamail to strip off all attachments and store them on
the Unix server where mail is delivered.  No more virii worries

TjL

    I have no complains about viruses from the users side too, but, regarding
    scripts we want to sleep well (:-)  Thanks to Lars Hecking, I checked it
    again here are the conclusions:

    In case of multipart/alternative metamail will miss some parts AND in
    some cases you will miss the mm.* file!  My emergency solution was to
    break the multipart/alternative hierarchical structure by grep(1)ing
    out the "multipart/alternative" lines.  The results:  Not all the
    parts of the message were extracted but, mm.* file still exist.
    The next solution, is less brutal and more hygiene:

        sed 's/[/]alternative;/[/]mixed;/' $MESSAGE | metamail ....

    In this way all the parts are extracted from the message (and I am
    going to sleep)

Bye,
 Udi

 

On Thu, 13 Dec 2001, Udi Mottelo wrote:

On Thu, 13 Dec 2001, Lars Hecking wrote:

[...]
#  sed(1) will save the header.  metamail(1) exctract (decode?) the 
message.
/bin/sed "/^From /,/^$/w $head" | /usr/bin/metamail -r -y -w -q -x 
2>/dev/null

 You should use reformime instead. metamail is old, buggy, and basically
 unmaintained. IIRC it cannot deal with multipart/alternative message,
 which then make an excellent inroad for (VBS) script worms/viruses,

  Thanks Lars, I didn't know that metamail is unmaintained and
[...]
-- 

John Conover        Tel. 408.370.2688  conover(_at_)rahul(_dot_)net
631 Lamont Ct.      Fax. 408.379.9602  http://www.johncon.com/
Campbell, CA 95008  Cel. 408.772.7733  

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>