MailScanner: Found dangerous Object Codebase/Data tag in HTML message

[Information Services]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

sendmail[8529]: j9SHoPAn008529:
from=<personalfinance-html-return-566-btinius=lovebox.com at mail2.marketwatchmail.com>,
size=23641, class=-60, nrcpts=1,
msgid=<200510281750.j9SHoPAn008529 at mail.lovebox.com>, proto=SMTP,
daemon=MTA, relay=l-qmqp2.marketwatchmail.com [63.240.173.124]

MailScanner[25119]: Message j9SHoPAn008529 from 63.240.173.124
(personalfinance-html-return-566-btinius=lovebox.com at mail2.marketwatchmail.com)
to lovebox.com is not spam, SpamAssassin (score=-0.134, required 3,
ALL_TRUSTED -1.00, AWL 0.40, BAYES_00 -2.60, HTML_EMBEDS 0.21,
HTML_MESSAGE 0.00, HTML_NONELEMENT_00_10 0.00, HTML_WEB_BUGS 0.04,
INVALID_DATE 0.24, MIME_HTML_ONLY 0.18, MIME_QP_LONG_LINE 0.04,
MISSING_MIMEOLE 0.01, MORTGAGE_RATES 0.20, MSGID_FROM_MTA_HEADER 0.05,
SARE_HTML_JVS_FLASH 0.99, SARE_URI_REFID1 1.11)

MailScanner[25119]: Content Checks: Detected and have disarmed HTML
message in j9SHoPAn008529 from
personalfinance-html-return-566-btinius=lovebox.com at mail2.marketwatchmail.com



On 10/28/05, Stephen Swaney <steve.swaney at fsl.com> wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> > Behalf Of Information Services
> > Sent: Friday, October 28, 2005 4:05 PM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: MailScanner: Found dangerous Object Codebase/Data tag in HTML
> > message
> >
> > Okay,
> >
> > I had a user that wanted to receive a newletter, but it was being blocked.
> > Looking through the archives I found what I need to do to take care of
> > this problem.  I edited MailScanner.conf and changed to:
> >
> > Allow Object Codebase Tags = /etc/MailScanner/rules/object.code.rules
> >
> > The contents of object.code.rules:
> >
> > # This file is to allow Object Codebase Tags from APPROVED domains.
> > # This next line gives an example of how you might enable this option for
> > # a frequent customer of yours.
> > #From:                yourcustomer.com        yes
> > From:         marketwatchmail.com     yes
> >
> > # Under no circumstances should this be changed to "yes".
> > FromOrTo:     default                 no
> > #
> > #
> >
> >
> > I stopped MailScanner, and sendmail,  did a ps -ef | grep ail to make
> > sure MailScanner and sendmail did in fact stop. Then started
> > MailScanner again.  I am trying to release the message to the user,
> > but it continues to be blocked.  What am i missing?  I went into
> > /var/spool/MailScanner/archives/%date%/%files% and tried to open them
> > in a browser but they are garbled up.  What do I need to do in order
> > to get this newsletter to the user?
> >
> > Casey
>
> What do the log files say about the message?
>
> Steve
>
> Stephen Swaney
> Fort Systems Ltd.
> stephen.swaney at fsl.com
> www.fsl.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!