possible Bug in 4.28.6 (long filenames)

Stephan Ilaender mailscanner at LAYLINE.DE
Wed Apr 7 12:26:11 IST 2004


Hi all,

I've had a mail blocked with the following remark:

Achtung: Very long filenames are good signs of attacks against Microsoft e-mail
packages (VK Preisliste .doc)

now "VK Preisliste .doc" ist not really that long and should not be matched by
this expression:

echo "VK Preisliste .doc" | egrep ".{150,}"

gives me no match. The file ends up like this in the quarantine dir:

/quarantine/20040407/A27541C110/VK\ Preisliste\ .doc

(Backslashes added for better reading) so there are really no hidden Whitespaces
etc.

any ideas on this?

regards,
Stephan

PS: it's still on 4.28.6 because I haven't had the time to upgrade it to 4.29.7



More information about the MailScanner mailing list