Re: [Exim] Generic VBS script detection

Top Page
Delete this message
Reply to this message
Author: Nigel Metheringham
Date: 2000-05-05 11:55 -000
To: Exim
Subject: Re: [Exim] Generic VBS script detection
P.A.Osborne@??? said:
> You are one sick puppy.


All plaudits gratefully received....

Its been suggest to me that we try and restrict this filter to stuff
that has a chance of matching...

The MIME attached form of the message will be a MIME multipart message
(is it possible to send single part messages other than text from a MS
type mailer?).
The uuencoded form is theoretical currently - can someone tell me *how*
that would be produced and whether it would end up with any header
signature, or whether this is a real outside possibility anyhow

This would simplify the filter to (this is psuedo code - ie it won't
run):-

   # initial stuff - tests reversed so we can bail out and
   # don't need to keep indenting further :-)
   if error_message or not first_delivery
   then
      finish
   endif


   if $h_content-type: contains multipart/mixed
   then
      # in here is only run for multipart/mixed messages
      if $message_body matches big-regexp
      then
         action (fail/log/freeze/save)
         seen finish
      endif
   endif


So the questions I need some response to:-

  1. Is the uuencoded in plain text a real problem so we need to look
     into body parts anyhow?


  2. Any MIME types (top level) other than mulitpart/mixed
     we must check for?


3. What proportion of messages are multipart?

  4. Multipart messages risk the top text part pushing the 
     nasty content out of the length of message_body
     How big is reasonable here....


I'm also considering doing a little work on exim code sometime to make
message_body a little less expensive than it is now - ie cache when
read in, whenever a copy is made its kept for the lifetime of that
message process.

    Nigel.
-- 
[ - Opinions expressed are personal and may not be shared by VData - ]
[ Nigel Metheringham                  Nigel.Metheringham@??? ]
[ Phone: +44 1423 850000                         Fax +44 1423 858866 ]