Re: [Exim] Blocking sobig.f

Top Page
Delete this message
Reply to this message
Author: Sheldon Hearn
Date:  
To: Jerry Bell
CC: Leonardo Boselli, exim-users
Subject: Re: [Exim] Blocking sobig.f
On (2003/08/20 18:15), Jerry Bell wrote:

> That is true. Fortunately, there are relatively few people who can execute
> perl and tcl files on their windows machines. The extensions that are
> blocked below actually come from a recommendation by Microsoft on what
> attachments are 'dangerous' and probably should be blocked.


Do you have a reference to Microsoft's recommendation? That'd make it a
lot easier for me to motivate for blocking the whole list.

I currently have pif and scr blocked, and WOW is it saving the virus
scanner a lot of work. :-)

And exim-4.22/exiscan-acl seems to handle the extensions case
insensitively, which is fantastic. So all you'd need would be

    demime = ade:adp:bas:bat:chm:cmd:com:cpl:crt:exe:hlp:hta:\
             inf:ins:isp:js:jse:lnk:mdb:mde:msc:msi:msp:mst:pcd:pif:\
             reg:scr:sct:shs:shb:url:vb:vbe:vbs:wsc:wsf:wsh


One thing.... Are you sure about "url"? Isn't that used to "attach
links"? I don't use a Wintendo mail client, so I don't know.

Ciao,
Sheldon.