Phishing emails cause MailScanner to loop infinitely

[Anthony Peacock]

Hi Jeff,

Jeff A. Earickson wrote:
> Anthony,
> 
> Sounds like the same problem I discovered yesterday.  Both you and
> I are running Solaris (10 sparc for me), the Linux/BSD crowd hasn't
> seen this yet?

It is comforting to know that it isn't only me :-)

And I have just realised that I didn't attach the log snippet to my 
original email. Its there this time...


> 
> Jeff Earickson
> Colby College
> 
> On Thu, 4 May 2006, Anthony Peacock wrote:
> 
>> Date: Thu, 04 May 2006 14:53:56 +0100
>> From: Anthony Peacock <a.peacock at chime.ucl.ac.uk>
>> Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
>> To: mailscanner at lists.mailscanner.info
>> Subject: Phishing emails cause MailScanner to loop infinitely
>>
>> Hi,
>>
>> I have just had to back out of MS 4.53.7 to MS 4.52.2, because the MS 
>> processes got stuck in a loop when they found a phishing email.
>>
>> I am running on Solaris 8 x86.
>>
>> After the upgrade all worked well for a while, and then I noticed that 
>> the incoming queue was getting backed up.  When I looked at the logs 
>> it appeared that the MS processes were looping around finding a 
>> phishing email.
>>
>> I have attached a text file with the relevant log lines for one of the 
>> processes.  In reality there were many MS processes stuck in these 
>> loops for different phishing sites.
>>
>> I have saved some of the queue files that caused this and once things 
>> have settled down may be able to test this in DEBUG mode.
>>
>> Backup off to MS 4.52.2 caused all of the queue to be processed 
>> successfully.
>>
>> -- 
>> Anthony Peacock
>> CHIME, Royal Free & University College Medical School
>> WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
>> "The most exciting phrase to hear in science, the one that heralds new 
>> discoveries, is not 'Eureka!' but 'That's funny....'" -- Isaac Asimov
>> -- 
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>> Before posting, read http://wiki.mailscanner.info/posting
>>
>> Support MailScanner development - buy the book off the website!


-- 
Anthony Peacock
CHIME, Royal Free & University College Medical School
WWW:    http://www.chime.ucl.ac.uk/~rmhiajp/
"The most exciting phrase to hear in science, the one that heralds new 
discoveries, is not 'Eureka!' but 'That's funny....'" -- Isaac Asimov
-------------- next part --------------
May  4 12:49:11 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: New Batch: Scanning 1 messages, 4115 bytes
May  4 12:49:13 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Virus and Content Scanning: Starting
May  4 12:49:18 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Uninfected: Delivered 1 messages
May  4 12:49:18 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Batch (1 message) processed in 6.61 seconds
May  4 12:49:18 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Logging message k44BnAXZ004181 to SQL
May  4 12:49:18 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: "Always Looked Up Last" took 0.00 seconds
May  4 12:51:06 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: New Batch: Found 5 messages waiting
May  4 12:51:06 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: New Batch: Scanning 1 messages, 5433 bytes
May  4 12:51:14 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Spam Checks: Found 1 spam messages
May  4 12:51:14 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Virus and Content Scanning: Starting
May  4 12:51:29 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:51:29 inetsrv-1.chime.ucl.ac.uk last message repeated 13 times
May  4 12:51:35 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:51:35 inetsrv-1.chime.ucl.ac.uk last message repeated 7 times
May  4 12:51:39 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:51:39 inetsrv-1.chime.ucl.ac.uk last message repeated 33 times
May  4 12:51:58 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:51:58 inetsrv-1.chime.ucl.ac.uk last message repeated 12 times
May  4 12:52:05 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:05 inetsrv-1.chime.ucl.ac.uk last message repeated 7 times
May  4 12:52:11 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:11 inetsrv-1.chime.ucl.ac.uk last message repeated 8 times
May  4 12:52:18 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:18 inetsrv-1.chime.ucl.ac.uk last message repeated 4 times
May  4 12:52:21 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:21 inetsrv-1.chime.ucl.ac.uk last message repeated 19 times
May  4 12:52:35 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:35 inetsrv-1.chime.ucl.ac.uk last message repeated 12 times
May  4 12:52:42 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:42 inetsrv-1.chime.ucl.ac.uk last message repeated 27 times
May  4 12:52:53 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:53 inetsrv-1.chime.ucl.ac.uk last message repeated 3 times
May  4 12:52:55 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:52:55 inetsrv-1.chime.ucl.ac.uk last message repeated 33 times
May  4 12:53:13 inetsrv-1.chime.ucl.ac.uk MailScanner[679]: Found phishing fraud from www.thecruisinglife.com claiming to be www.hsbc.co.uk in k44Bp21P004322
May  4 12:53:13 inetsrv-1.chime.ucl.ac.uk last message repeated 62 times