FixMaliciousSubjects is cutting legim Subject lines.

Sveinn Gunnarsson sveinn at SVEINNG.COM
Thu Feb 5 00:14:30 GMT 2004


The Subject line apperas last in the headers of the modified emails like this:

--%<------
X-OgVodafone-MailScanner-SpamScore: ss
Subject: Re: WinCABAS:
---%<------

Thanks,
Svenni...

> What is it reducing them to? I can't see anything in the code snippet that
> would touch the sample subject line you gave.
>
> At 15:25 04/02/2004, you wrote:
> >Hi Julian.
> >
> >I have found that the FixMaliciousSubjects sub in SweepContent.pm is cutting
> >of non-exploit subject lines. These mails are sent from Lotus Notes server.
> >I have not seen this happening when receiving mail from other servers.
> >
> >Here is a header-snip of one such email:
> >
> >
> >From: yy at yy.is
> >In-Reply-To:
> ><OF5E723B86.F88E8AE4-ON00256E2F.0034C5CC-00256E2F.0034FB02 at LocalDomain>
> >Subject: Re: WinCABAS:
> > =?iso-8859-1?Q?Bifei=F0averkst=E6=F0i_=C1rna_G=EDslasonar_hf=2C_MV128-02?=
> > =?us-ascii?Q?=2E=2E?= =?iso-8859-1?Q?=ED__cabas=2C_G=F3l?=
> >To: xx at xx.is
> >
> >
> >I have disabled these three lines in SweepContent.pm to let these subjects
> >through, but a more elegant soulution would be nice :)
> >
> >#  $newsubject =~ s/\s{20,}.*\..{1,4}\s*$//; # Delete file extensions at end
> >of filename
> >#  $newsubject =~ s/\s*$//g;
> >#  $newsubject =~ s/\s{20,}//g;
> >
> >
> >
> >Thanks in advance !
> >
> >Sveinn G. Gunnarsson
> >UNIX Specialist
> >
> >Og Vodafone
> >Sidumuli 28
> >108 Reykjavik
> >Iceland
> >www.ogvodafone.is
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654



More information about the MailScanner mailing list