WMF Exploit

[shuttlebox]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On 12/29/05, Rodney Green <rgreen at trayerproducts.com> wrote:
      With the WMF Zero-day exploit on the loose does MailScanner
      have the ability to detect WMF files - other than by
      extension - using the filetype.rules.conf file?


Try the file command on a wmf-file, if you're lucky it's detected as
something unique and you can use that in the filetype.rules.conf-file but
if it's something like "data" or other generic type you can always roll
your own magic signature, look in /etc/magic.

I just blocked it in filename.rules.conf myself.

--
/Peter
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!