Strange filename construct being blocked?

[UTF-8] David Höhn dh at UPTIME.AT
Thu Dec 2 09:31:00 GMT 2004


    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Hello.

I was seing a message like this one:

Very long filenames are good signs of attacks against Microsoft e-mail
packages (trpix.gif%3F%26rdm.net)

now I know that %3F is ? and %26 is &. So that would make the filename

trpix.gif?&rdm.net

Is this some sort of new attack?

- -d

PS: Latest Stable MailScanner

- --
nee anata wo mitsukete soshite nidoto wasurezu
~      donna ni munega itakutemo soba ni iru no
~                         zutto...zutto...zutto
Key fingerprint = FD77 F0B7 5C65 F546 EB08  A4EC 3CCA 1A32 7E24 291E
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (Darwin)

iD8DBQFBruDUPMoaMn4kKR4RA+BjAJ9KAEkrDZuPUKtMzSVnXfvlQYgS6wCgnuF0
RIUbIBbkJhJhZMqgohvGcZ0=
=Kz2E
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!




More information about the MailScanner mailing list