<html>
Ouch!<br><br>
Well done for spotting this one. It affects all virus scanning engines,
and both Version 3 and Version 4.<br><br>
<b>The patch for version 4 is this:<br><br>
</b>diff -Naur
/root/unstable/mailscanner/mailscanner/bin/MailScanner/Message.pm
Message.pm<br>
---
/root/unstable/mailscanner/mailscanner/bin/MailScanner/Message.pm
Wed Oct 23 21:27:17 2002<br>
+++ Message.pm Tue Oct 29 10:37:14 2002<br>
@@ -1836,7 +1836,8 @@<br><br>
# Construct all the attachments<br>
foreach $attachment (@files) {<br>
-
$top->attach(Path =>
"$attachment",<br>
+ # Added "./" to start of next line to avoid
potential DoS attack<br>
+
$top->attach(Path =>
"./$attachment",<br>
Type =>
"application/octet-stream",<br>
Encoding => "base64",<br>
Disposition => "attachment");<br><br>
<b>The patch for version 3 is this:<br><br>
</b>--- disinfect.pl.old Tue Oct 29 10:38:50 2002<br>
+++ disinfect.pl Tue Oct 29
10:39:11 2002<br>
@@ -144,7 +144,8 @@<br>
$top->attach(Data=>$message);<br><br>
foreach $attachment
(@{$CleanedUp{"$id"}}) {<br>
-
$top->attach(Path =>
"$attachment",<br>
+ # Added "./" to next line to
avoid possible DoS attach<br>
+
$top->attach(Path =>
"./$attachment",<br>
Type =>
"application/octet-stream",<br>
Encoding => "base64",<br>
Disposition => "attachment");<br><br>
I will produce new versions of both V3 and V4 very soon.<br><br>
At 08:54 29/10/2002, you wrote:<br>
<blockquote type=cite class=cite cite>-----BEGIN PGP SIGNED
MESSAGE-----<br>
Hash: SHA1<br><br>
Hello *,<br><br>
MailScanner-4.03-1, when it meet a vired attach named with a name
starting <br>
with a space, it dies.<br>
The same behaviour there was with version 3. <br>
so I thing this may be a possible Dos.<br><br>
mirko<br><br>
<br><br>
Oct 29 07:28:08 aurora MailScanner[14250]: MailScanner<br>
Oct 29 07:28:08 aurora MailScanner[14250]: MailScanner E-Mail Virus
Scanner <br>
version 4.03-1 starting...<br>
Oct 29 07:28:08 aurora MailScanner[14250]: Using locktype = flock<br>
Oct 29 09:28:09 aurora sendmail[14252]: g9T8S9L14252: <br>
from=<mirko@aurora.lorenzo.com>, size=328245, class=0, nrcpts=1,
<br>
msgid=<200210290828.g9T8S9L14252@aurora.lorenzo.com>, proto=SMTP,
daemon=MTA, <br>
relay=[192.168.36.81]<br>
Oct 29 07:28:13 aurora MailScanner[14250]: New Batch: Scanning 1
messages, <br>
328709 bytes<br>
Oct 29 07:28:13 aurora MailScanner[14250]: Virus and Content Scanning:
<br>
Starting<br>
Oct 29 07:28:14 aurora MailScanner[14250]: /g9T8S9L14252/
corponew.doc <br>
Found the W97M/Thus.gen virus !!!<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Virus Scanning: mcafee found 1
<br>
infections<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Virus Scanning: Found 1
viruses<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Saved infected "
corponew.doc" to <br>
/var/spool/MailScanner/quarantine/20021029/g9T8S9L14252<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Cleaned: Delivered 1 cleaned
<br>
messages<br>
Oct 29 09:28:14 aurora sendmail[14259]: g9T8SEk14259: from=<>,
size=620, <br>
class=0, nrcpts=1,
msgid=<200210290828.g9T8SEk14259@aurora.lorenzo.com>, <br>
relay=root@localhost<br>
Oct 29 09:28:14 aurora sendmail[14258]: g9T8S9L14252: <br>
to=<mirko@aurora.lorenzo.com>,
ctladdr=<mirko@aurora.lorenzo.com> (500/500), <br>
delay=00:00:05, xdelay=00:00:00, mailer=local, pri=448245, dsn=2.0.0,
<br>
stat=Sent<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Sender Warnings: Delivered 1
<br>
warnings to virus senders<br>
Oct 29 09:28:14 aurora sendmail[14266]: g9T8SE314266: from=postmaster,
<br>
size=443, class=0, nrcpts=1, <br>
msgid=<200210290828.g9T8SE314266@aurora.lorenzo.com>,
relay=root@localhost<br>
Oct 29 09:28:14 aurora sendmail[14264]: g9T8SEk14259: <br>
to=mirko@aurora.lorenzo.com, delay=00:00:00, xdelay=00:00:00,
mailer=local, <br>
pri=30620, dsn=2.0.0, stat=Sent<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Notices: Warned about 1
messages<br>
Oct 29 07:28:14 aurora MailScanner[14250]: Disinfection: Attempting to
<br>
disinfect 1 messages<br>
Oct 29 09:28:14 aurora sendmail[14269]: g9T8SE314266: to=root,
delay=00:00:00, <br>
xdelay=00:00:00, mailer=local, pri=30443, dsn=2.0.0, stat=Sent<br>
read-open corponew.doc: No such file or directory at <br>
/usr/lib/perl5/site_perl/5.6.1/MIME/Body.pm line 417.<br>
Oct 29 07:28:15 aurora MailScanner[14250]: Disinfection: Rescan found
only 0 <br>
viruses<br>
Oct 29 09:28:16 aurora sendmail[14273]: g9T8SG914273: from=postmaster,
<br>
size=916, class=0, nrcpts=1, <br>
msgid=<200210290828.g9T8SG914273@aurora.lorenzo.com>,
relay=root@localhost<br>
Oct 29 09:28:16 aurora sendmail[14276]: g9T8SG914273: <br>
to=mirko@aurora.lorenzo.com, delay=00:00:00, xdelay=00:00:00,
mailer=local, <br>
pri=30916, dsn=2.0.0, stat=Sent<br>
Oct 29 07:28:18 aurora MailScanner[14279]: MailScanner<br>
Oct 29 07:28:18 aurora MailScanner[14279]: MailScanner E-Mail Virus
Scanner <br>
version 4.03-1 starting...<br>
Oct 29 07:28:18 aurora MailScanner[14279]: Using locktype =
flock<br><br>
<br><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.0.6 (GNU/Linux)<br>
Comment: For info see
<a href="http://www.gnupg.org/" eudora="autourl">http://www.gnupg.org</a><br><br>
iD8DBQE9vkzVmXvUZ7obFPgRAgBPAJ4tDBpKtoAVmVIjKGWSwD8NlBYBagCfQSq3<br>
tgfwcu3xz84csolW4obhQk4=<br>
=EmDb<br>
-----END PGP SIGNATURE-----</blockquote><br>
<div>-- </div>
<div>Julian
Field
Teaching Systems Manager</div>
<div>jkf@ecs.soton.ac.uk
Dept. of Electronics & Computer Science</div>
<div>Tel. 023 8059
2817 University of
Southampton</div>
Southampton SO17 1BJ
</html>