Internet Explorer URL Display problem

Antony Stone Antony at SOFT-SOLUTIONS.CO.UK
Wed Dec 10 19:55:20 GMT 2003

On Wednesday 10 December 2003 7:46 pm, Daniel Bird wrote:

> Off the top of my head, could you not do a simple SA rule like so:
> describe IE_VULN Body of email contains %01@ in a url
> uri IE_VULN / %01@/
> score IE_VULN 10.0
> Which would look for that pattern in a url.

The above isn't specific to finding the pattern in a URL - although admittedly
I can't think of a valid reason why you'd expect to see a %01 anywhere, URL
or not.

Note by the way that the original notification referred to the %01 being
*after* the @ sign, not before it (before too many people go off and concoct
various pattern matches for the wrong pattern!)


Ramdisk is not an installation procedure.

                                                     Please reply to the list;
                                                           please don't CC me.

More information about the MailScanner mailing list