Re: [Exim] IRC/Stages.worm and system_filter.exim

Quoth Jethro R Binks on Tue, Jun 20, 2000:
> For those sites who don't want to block copious amounts of attachment with
> these filters, I wonder if a simpler filter that blocked any attachment
> called somefile.txt.ext (.ext could be any value) would be a reasonable
> compromise: certainly some of the recent ones we've seen try to disguise
> the nature of the file by making it appear to have a .txt extension (when
> it really has another further extension, the one Windows takes notice of).

First, it may be .gif.vbs instead of .txt.vbs any time. Second,
Windows mailers should NOTICE THE FREAKING MIME TYPE INSTEAD OF
THE FREAKING SO-CALLED EXTENSION. But that's not our fault.

> This thought was derived from a comment by one of my users about blocking
> "double extension" attachments.

Don't know about you, but I like .tar.gz files, as well as
.c.bz2, .1.Z, and -6.09.00.

> Comments?

Everything we do is doomed to fail at some point or another.
Nothing that was proposed and implemented here, or in any other
place I've seen (including the anti-viruses), is a solution to
this problem. As long as users use insecure mailers on insecure
operating systems, viruses, worms, and other creatures will
exist. Those who use Outloop and friends bring it on themselves.
Meanwhile, my dad is happy using UNIX mailers -- I told him I
would not appreciate security holes in whatever he uses.

Vadik.

--
Do not meddle in the affairs of sysadmins, they are quick to
anger and have no need for subtlety.