HTML-specific exploits and whitelists

[Jeff Earickson]

Hi,
   I think there are three different HTL exploits that MS can stomp on,
as of 4.29.x.  Search for "disarm" in MailScanner.conf.  I had a case
today where HTML email from factiva.com had quit coming thru as of
March 18, the date that I upgraded from 4.28.6 to 4.29.3.  The problem
was caused by the new feature "Allow Script Tags = no" introduced in
4.29.x.  I changed this to "disarm" and my problem went away.

Jeff Earickson
Colby College

On Fri, 2 Apr 2004, System Admins wrote:

> Date: Fri, 2 Apr 2004 12:36:34 -0500
> From: System Admins <sysadmins at ENHTECH.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: HTML-specific exploits and whitelists
>
> At 11:54 AM 4/2/2004, you wrote:
> >How about you use a ruleset so the HTML checks are not done on mail from
> >your cold fusion server.
>
> Actually, Please disregard that. I don't need an example.
> Are HTML-specific exploits referred to as Script Tags?
>
>
> Errol Neal
>