Re: [Exim] IRC/Stages.worm and system_filter.exim

Página superior
Eliminar este mensaje
Responder a este mensaje
Autor: Jethro R Binks
Fecha:  
A: exim-users
Asunto: Re: [Exim] IRC/Stages.worm and system_filter.exim
Hmm.

For those sites who don't want to block copious amounts of attachment with
these filters, I wonder if a simpler filter that blocked any attachment
called somefile.txt.ext (.ext could be any value) would be a reasonable
compromise: certainly some of the recent ones we've seen try to disguise
the nature of the file by making it appear to have a .txt extension (when
it really has another further extension, the one Windows takes notice of).

This thought was derived from a comment by one of my users about blocking
"double extension" attachments.

Comments?

Jethro.


On Mon, 19 Jun 2000, Douglas Gray Stephens wrote:

>
> Hi,
>
> There is another Windows worm doing the rounds (see
> http://vil.nai.com/villib/dispvirus.asp?virus_k=98668
> ) using an extension of SHS
>
> I am not sure who is maintaining the system_filter.exim file, but the
> current version (0.5)
> ftp://ftp.exim.org/pub/filter/system_filter.exim
> does not trap files with extension "SHS". I believe that the file
> needs updating, with something similar to the attached file.
>
> Cheers,
>
> Douglas.
>
>



. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Jethro R Binks                                   Computing Officer, IT Services
Webmaster, Cachemaster, Listmaster;      University Of Strathclyde, Glasgow, UK
                                                      jethro.binks@???