On Wed, 17 Jul 2002 08:06 , Derrick 'dman' Hudson <dsh8290@???> said:
> --
> On Wed, Jul 17, 2002 at 11:40:00AM +0100, Erik Erskine wrote:
> | I've been using the filter at ftp://ftp.exim.org/pub/filter, this is
> | helpful.
> |
> | It stops attachments with a .eml extension, and I've had users complain
> | that they are unable to forward mails containing other attachments.
> | Their mail client (Mozilla on Windows) sends a message with an
> | attachment "ForwardedMessage.eml" which itself contains the other
> | attachments.
> |
> | I've had to remove the check for .eml from the filter. What messages
> | will now pass through that shouldn't? I'm assuming that any executable
> | content will be caught by checking the nested attachments.
>
> EML is a (Microsoft) way of serializing arbitrary OLE objects. The
> EML can contain _anything_, including just a simple email message or a
> worm.
e.g.
Content-Type: message/rfc822;
name=the pass to master.XXX
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename="the pass to master.XXX"
Return-Path: < ms0u1086@??? >
Received: from mx2.liverpool.ac.uk ([1.0.255.53])
From: <ms0u1086@???>
To: afrotweeney@???
Subject: the pass to master
....worm....
>
eml XXX'd out.
--
Alan
