<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2653.12">
<TITLE>RE: Detected HTML-specific exploits</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>I figured as much. I suppose I was looking for a more specific log entry or that I wanted to validate that this log entry could correspond to a script block and was not some other ruleset somewhere that I didn't know about (there is no clear indication of what an HTML-specific exploit is if you are just looking at logs and don't realize it is object codebase, forms, iframes, scripts, etc). </FONT></P>
<P><FONT SIZE=2>I have reviewed the disarm setting and the "not 100% effective" concerns me. I may use a ruleset to "disarm" from certain domains that we need to permit for busines purposes and leave the rest of the world set to no. Has anyone seen any situations where disarm permitted exploit code through?</FONT></P>
<P><FONT SIZE=2>> That is your answer.</FONT>
<BR><FONT SIZE=2>> </FONT>
<BR><FONT SIZE=2>> If you are blocking script tags then you do run the risk of </FONT>
<BR><FONT SIZE=2>> blocking HTML emails. A more sane setting would be "disarm"</FONT>
</P>
</BODY>
</HTML>
-------------------------- MailScanner list ----------------------<br>
To leave, send leave mailscanner to <a href="mailto:jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a><br>
Before posting, please see the Most Asked Questions at<br>
<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a> and the archives at<br>
<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a><br>